Knowledge Center

How to manually remove VirusScan Enterprise 8.8
Technical Articles ID:  KB71179
Last Modified:  8/12/2015


McAfee VirusScan Enterprise (VSE) 8.8 Patch 0 - 4 
NOTE: This article does not apply if another Intel Security product is present that has installed SYSCore 15.3 or later drivers (such as VSE 8.8 patch 5).

For product supported environments, see KB51111.


This article describes how to manually remove VSE 8.8 if automatic removal is not an option or fails.

IMPORTANT: Use the following instructions only as a last resort for removing VSE 8.8. Before attempting a manual removal, try all other methods first.

CAUTION: This article contains information about opening or modifying the registry.
  • The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
  • Before proceeding, Intel Security strongly recommends backing up your registry and understanding the restore process. For more information, see: http://support.microsoft.com/kb/256986.
  • Do not run a .REG file that is not confirmed to be a genuine registry import file.

Use one of the following solutions that best fits your requirements:

Solutions Descriptions
Use msiexec.exe to remove remnants (if Add/Remove Programs is unavailable)
Full manual removal instructions for 32-bit systems
Full manual removal instructions for 64-bit systems
Use this solution if you plan to re-install VSE 8.8

Solution 1

Use msiexec.exe to remove remnants (if Add/Remove Programs is unavailable)

Sometimes you can remove VSE remnants using msiexec.exe with the product installation string. This method saves time, and Intel Security recommends that you use this method before you try to manually remove VSE using any of the remaining solutions.

For full details on how to remove VSE via the command line using msiexec.exe, see KB52648.

Solution 2

Full manual removal instructions for 32-bit systems
This solution is not applicable if SYSCore 15.3 or later drivers are present. Check the version of the file %windir%\System32\Drivers\MFEHIDK.SYS before continuing.
  1. Disable Access Protection:
    1. Click StartProgramsMcAfeeVirusScan Console.
    2. Right-click Access Protection and select Disable.
    3. Close the VirusScan Console
  2. Stop the VirusScan Services:
    IMPORTANT: Your system will be unprotected after this step. Intel Security recommends that you continue working while disconnected from the network.
    1. Click StartRun, type NET STOP McShield, and press ENTER.
    2. Click StartRun, type NET STOP McTaskManager, and press ENTER. 
  3. Remove the Common Management Agent (CMA) reference for VSE:
    1. Click StartRun.
    2. Type the following command and press ENTER:
      <CMA install folder>\FRMINST.exe /REMOVE=Updater /PRODUCT=VIRUSCAN8800
      Example: "C:\Program Files\McAfee\Common Framework\frminst.exe" /REMOVE=Updater /PRODUCT=VIRUSCAN8800
      NOTE: The default location for the CMA installation folder is: C:\Program Files\McAfee\Common Framework
  4. Unload the McTray Plugin, if necessary.
    1. Click Start, Run.
    2. Type the following command and press ENTER:
      <CMA Install Folder>\mctray.exe unloadplugin=shstat.dll
      Example: “C:\Program Files\McAfee\Common Framework\mctray.exe” unloadplugin=shstat.dll 
  5. Delete the VSEPlugin key:
    1. Click Start, Run, type regedit and press ENTER.
    2. Delete the following key:
  6. Stop the ShStat process
    1. Click Start, Run.
    2. Type the following and press ENTER:
      <VSE Install Folder>\shstat.exe /TERMINATE
      Example: “C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe” /TERMINATE
  7. Unregister with Checkpoint:
    1. Click StartRun.
    2. Type the following command and press ENTER:
      <VirusScan install folder>\PIREG.EXE /d <VirusScan install folder>\MCAVSCV.DLL
      Example: "C:\Program Files\McAfee\VirusScan Enterprise\PIREG.EXE" /d "C:\Program Files\McAfee\VirusScan Enterprise\MCAVSCV.DLL"

      NOTE: The default location for the VirusScan installation folder is: C:\Program Files\McAfee\VirusScan Enterprise.   
  8. Remove Lotus Scanner:
    1. Click StartRun.
    2. Type the following and press ENTER:
      <VirusScan install folder>\NCDAEMON.exe -remove
      Example: "C:\Program Files\McAfee\VirusScan Enterprise\NCDAEMON.exe" -remove
  9. Unload vsplugin.dll (if the McAfee Agent is installed):
    1. Browse to the following registry location:
      HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
    2. Right-click Plugin Flag and select Modify.
    3. In the Value Data field type and click OK.
    4. Browse to the following registry location:
      HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
    5. Right-click Plugin Flag and select Modify.
    6. In the Value Data field type and click OK
  10. Remove VirusScan Drivers:
    1. Copy the vse.xml and DAInstall.exe files into the <VSE Install Directory>\vscore folder. (See Related Information for details on how to obtain these two files.)
    2. Select StartRun, type cmd, and press ENTER.
    3. Change directory to the VirusScan VSCore folder.
      Example: cd "c:\program files\mcafee\virusscan enterprise\vscore"
    4. Type mfehidin.exe -u –x vse.xml and press ENTER. 
  11. Delete VirusScan Services:
    1. Click StartRun, type regedit, and press ENTER.
    2. Locate the following registry key:
    3. Create a DWORD value named DeleteFlag with a value of 1
    4. Create a DWORD value named VSEFlag with a value of 1
  12. Unregister the shell extension:
    1. Click StartRun, type regedit , and press ENTER.
    2. Locate each of the following registry keys, right-click each key, and select Delete:
  1. Reboot the computer.
  2. Unregister DLLs:
    1. Select StartRun, type cmd, and press ENTER.
    2. Locate and change to the VirusScan installation folder.
      Example: cd "c:\Program Files\McAfee\VirusScan Enterprise"
    3. Type the following command and press ENTER: 
      regsvr32.exe /u VSUPDATE.dll
    4. Locate and change to the McAfee SystemCore installation folder.
      Example: cd "c:\Program Files\Common Files\McAfee\SystemCore"
    5. Type the following command and press ENTER: 
      regsvr32.exe /u SCRIPTSN.dll
  3. Delete Files/Folders:
    1. Delete the following files:
      %ALLUSERSPROFILE%\Start Menu\Programs\McAfee\On-Access Scan.lnk
      %ALLUSERSPROFILE%\Start Menu\Programs\McAfee\On-Demand Scan.lnk
      %ALLUSERSPROFILE%\Start Menu\Programs\McAfee\VirusScan Console.lnk

    2. Delete each of the following program folders:
      C:\Program Files\Common Files\McAfee\Engine 
      %ALLUSERSPROFILE%\Application Data\McAfee\DesktopProtection 
      C:\Program Files\McAfee\VirusScan Enterprise 

    3. Delete each of the following folders if empty:
      %ALLUSERSPROFILE%\Start Menu\Programs\McAfee
      %ALLUSERSPROFILE%\Application Data\McAfee 
      C:\Program Files\Common Files\McAfee
      C:\Program Files\McAfee

  4. Delete Registry Keys - Part 1:
    1. Click StartRun, type regedit, and press ENTER.
    2. Locate each of the following keys, right-click each key, and select Delete:
HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run], ShStatEXE
  1. Delete Registry Keys - Part 2:
    To search the Windows Registry for and delete instances of 6B1D51EC6B91D4D4F834FCD5C23365FF:
    1. Click StartRun, type regedit, and press ENTER.
    2. Select EditFind, type 6B1D51EC6B91D4D4F834FCD5C23365FF, and click Find Next.
    3. Right-click any matching key found and select Delete.
      NOTE: Delete the parent key if there are no other values in the key.
      See the Related Information section for a full listing of all registry values that should be located and removed in this way.  
  1. Reset Microsoft Outlook Add-in Manager (if Microsoft Outlook is installed):

    NOTE: This procedure instructs Microsoft Outlook to rebuild the EXTEND.DAT for the next user to open Outlook, removing references to the VirusScan Email Scan add-in.
  1. Click StartRun, type regedit, and click OK.
  2. Locate the following registry location:
  3. Right-click the Extensions key and select NewString Value.
  4. Rename the new value to Outlook Setup Extension and press ENTER.
  5. Right-click Outlook Setup Extension and select Modify.
  6. In the Value Data field, type 4.0;Outxxx.dll;7;00000000000000;0000000;OutXXX and press ENTER.

Solution 3

Full manual removal instructions for 64-bit systems
IMPORTANT: This solution is not applicable if SYSCore 15.3 or later drivers are present. Check the version of the file %windir%\System32\Drivers\MFEHIDK.SYS before continuing.

The 32-bit instructions apply with the following exceptions:  
  • 64-bit directory structure

    Replace C:\Program Files\... 
    with C:\Program Files (x86)\...
  • 64-bit registry locations

    Replace HKEY_LOCAL_MACHINE\Software\McAfee
    with HKEY_LOCAL_MACHINE\Software\Wow6432Node\McAfee

Solution 4

Use this solution if you plan to re-install VSE 8.8
This solution is not applicable if SYSCore 15.3 or later drivers are present. Check the version of the file %windir%\System32\Drivers\MFEHIDK.SYS before continuing.

This solution is intended to be used when the product is failing due to existing registry/file/folder corruptionan and the administrator wants to perform a manual removal and re-installation.

  • This procedure relies on the assumption that Access Protection can either be disabled, or is non-functional on the system. The following information is all that is necessary to remove registry/file corruption for VSE only, and perform a clean install.
  • Ensure there is no other McAfee software installed on the system. This includes removing the McAfee Agent. Performing this procedure can also remove drivers shared by Host Intrusion Prevention.
  1. Click Start, Run, type regedit, and then click OK.
  2. Navigate to HKLM\System\CurrentControlSet\Services, and delete the following Keys:

    NOTE: Perform this step for the McAfee services listed under the additional CurrentControlSet0#\Services keys as well, if they exist.

    (NOTE: Possibly appears as mfetdik.sys, or mfetdi2k.sys, depending on whether the operating system is 32-bit or 64-bit)
  3. Navigate to the appropriate location and delete the McAfee key:
    32-bit systems: HKLM\Software
    64-bit systems: HKLM\Software\Wow6432Node 
  4. In Windows Explorer, navigate to one of the following locations and delete the McAfee folder:
    32-bit systems: C:\Program Files
    64-bit systems: C:\Program files (x86)
    32-bit systems: C:\Program Files\Common Files (if it exists)
    64-bit systems: C:\Program Files (x86)\Common Files
  5. Navigate to C:\Windows\System32\drivers and  delete the following files:
    IMPORTANT:  Delete only the listed drivers. In certain scenarios, there could be non-McAfee drivers that start with mfe*, and deleting those drivers could cause unwanted system changes.

  6. Navigate to C:\Windows\System 32 and delete mfevtps.exe.
  7. Restart the system and attempt a new local installation.

Rate this document

Did this article resolve your issue?

Please provide any comments below

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.