Loading...

Knowledge Center


How to manually remove VirusScan Enterprise 8.8
Technical Articles ID:  KB71179
Last Modified:  04/04/2014
Rated:


Environment

McAfee VirusScan Enterprise (VSE) 8.8

For product supported environments, see KB51111.

Summary

This article describes how to manually remove VSE 8.8 if automatic removal is not an option or fails.

IMPORTANT: Use the following instructions only as a last resort for removing VirusScan Enterprise 8.8. Before attempting a manual removal, try all other methods first.

CAUTION: This article contains information about opening or modifying the registry.
  • The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
  • Before proceeding, McAfee strongly recommends backing up your registry and understanding the restore process. For more information, see: http://support.microsoft.com/kb/256986.
  • Do not run a .REG file that is not confirmed to be a genuine registry import file.

Solution 1

Use msiexec.exe to remove remnants (if Add/Remove Programs is unavailable)
Sometimes you can remove VSE remnants using msiexec.exe with the product installation string. This can save time and McAfee recommends that you use this method before you try to manually remove VSE .

For full details on how to remove VirusScan Enterprise via the command line using msiexec.exe, see KB52648.

Solution 2

Manual removal procedure for VSE 8.8i (32-bit installations)
  1. Disable Access Protection
    1. Click StartProgramsMcAfeeVirusScan Console.
    2. Right-click Access Protection and select Disable.
    3. Close the VirusScan Console
       
  2. Stop the VirusScan Services
    IMPORTANT: Your system will be unprotected after this step. For security, you may prefer to continue working while disconnected from the network. 
    1. Click StartRun, type NET STOP McShield, and press ENTER.
    2. Click StartRun, type NET STOP McTaskManager, and press ENTER. 
       
  3. Remove the Common Management Agent (CMA) reference for VirusScan Enterprise
    1. Click StartRun.
    2. Type: <CMA install folder>\FRMINST.exe /REMOVE=Updater /PRODUCT=VIRUSCAN8800 and press ENTER.

      Example: "C:\Program Files\McAfee\Common Framework\frminst.exe" /REMOVE=Updater /PRODUCT=VIRUSCAN8800

      NOTE: The default location for the CMA installation folder is: C:\Program Files\McAfee\Common Framework. 
       
  4. Unload the McTray Plugin if necessary
    1. Click Start, Run.
    2. Type: <CMA Install Folder>\mctray.exe unloadplugin=shstat.dll and press ENTER.

      Example: “C:\Program Files\McAfee\Common Framework\mctray.exe” unloadplugin=shstat.dll 
       
  5. Delete the VSEPlugin key
    1. Click Start, Run, type regedit and press ENTER.
    2. Delete the following key:

      HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\McTray\Plugins\VSEPlugin
       
  6. Stop the ShStat process
    1. Click Start, Run.
    2. Type: <VSE Install Folder>\shstat.exe /TERMINATE

      Example: “C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe” /TERMINATE
       
  7. Unregister with Checkpoint
    1. Click StartRun.
    2. Type: <VirusScan install folder>\PIREG.EXE /d <VirusScan install folder>\MCAVSCV.DLL and press ENTER.

      Example: "C:\Program Files\McAfee\VirusScan Enterprise\PIREG.EXE" /d "C:\Program Files\McAfee\VirusScan Enterprise\MCAVSCV.DLL"

      NOTE: The default location for the VirusScan installation folder is: C:\Program Files\McAfee\VirusScan Enterprise.   
       
  8. Remove Lotus Scanner
    1. Click Start, Run.
    2. Type: <VirusScan install folder>\NCDAEMON.exe -remove and press ENTER.

      Example: "C:\Program Files\McAfee\VirusScan Enterprise\NCDAEMON.exe" -remove
       
  9. Unload vsplugin.dll (if ePolicy Orchestrator Agent is installed)
    1. Browse to the following registry location:

      HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
       
    2. Right-click Plugin Flag and select Modify.
    3. In the Value Data field type and click OK.
    4. Browse to the following registry location:

      HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
       
    5. Right-click Plugin Flag and select Modify.
    6. In the Value Data field type and click OK
       
  10. Remove VirusScan Drivers
    1. Copy the vse.xml and DAInstall.exe files into the <VSE Install Directory>\vscore folder. (See Related Information for details on how to obtain these two files.)
    2. Select StartRun, type cmd, and press ENTER.
    3. Change directory to the VirusScan VSCore folder.

      Example: cd "c:\program files\mcafee\virusscan enterprise\vscore"
       
    4. Type: mfehidin.exe -u –x vse.xml and press ENTER. 
       
  11. Delete VirusScan Services
    1. Click StartRun, type regedit, and press ENTER.
    2. Locate the following registry key:

      HKEY_LOCAL_MACHINE\System\ControlSet\Services\McTaskManager
       
    3. Create a DWORD value named DeleteFlag with a value of 1.
    4. Create a DWORD value named VSEFlag with a value of 1. 
       
  12. Unregister the shell extension
    1. Click Start, Run, type regedit , and press ENTER.
    2. Locate each of the following registry keys, right-click each key, and select Delete:
HKEY_CLASSES_ROOT\CLSID\{cda2863e-2497-4c49-9b89-06840e070a87}
HKEY_CLASSES_ROOT\Directory\shellex\ContextMenuHandlers\VirusScan
HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\VirusScan
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\VirusScan 
  1. Reboot the computer
     
  2. Unregister DLLs
    1. Select StartRun, type cmd, and press ENTER.
    2. Locate and change to the VirusScan installation folder.

      Example: cd "c:\Program Files\McAfee\VirusScan Enterprise"

    3. Type the following command and press ENTER: 

      regsvr32.exe /u VSUPDATE.dll
       
    4. Locate and change to the McAfee SystemCore installation folder.

      Example: cd "c:\Program Files\Common Files\McAfee\SystemCore"

    5. Type the following command and press ENTER: 

      regsvr32.exe /u SCRIPTSN.dll
       
  3. Delete Files/Folders
    1. Delete the following files:

      %ALLUSERSPROFILE%\Start Menu\Programs\McAfee\On-Access Scan.lnk
      %ALLUSERSPROFILE%\Start Menu\Programs\McAfee\On-Demand Scan.lnk
      %ALLUSERSPROFILE%\Start Menu\Programs\McAfee\VirusScan Console.lnk
       
    2. Delete each of the following program folders:

      C:\Program Files\Common Files\McAfee\Engine 
      %ALLUSERSPROFILE%\Application Data\McAfee\DesktopProtection 
      C:\Program Files\McAfee\VirusScan Enterprise 
      C:\WINDOWS\Installer\{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}

       
    3. Delete each of the following folders if empty:

      %ALLUSERSPROFILE%\Start Menu\Programs\McAfee
      %ALLUSERSPROFILE%\Application Data\McAfee 
      C:\Program Files\Common Files\McAfee
      C:\Program Files\McAfee
       
  4. Delete Registry Keys - Part 1
    1. Click StartRun, type regedit, and press ENTER.
    2. Locate each of the following keys, right-click each key, and select Delete:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\6B1D51EC6B91D4D4F834FCD5C23365FF
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\9FF15957780018945A6265BC95AD719D
HKEY_CLASSES_ROOT\Installer\Products\6B1D51EC6B91D4D4F834FCD5C23365FF
HKEY_CLASSES_ROOT\Installer\Features\6B1D51EC6B91D4D4F834FCD5C23365FF
HKEY_CLASSES_ROOT\Installer\UpgradeCodes\9FF15957780018945A6265BC95AD719D
HKEY_CURRENT_USER\Software\McAfee\DesktopProtection
HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\AVEngine
HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection
HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run], ShStatEXE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\Services\Eventlog\Application\McLogEvent 
  1. Delete Registry Keys - Part 2
    To search the Windows Registry for and delete instances of 6B1D51EC6B91D4D4F834FCD5C23365FF:
    1. Click StartRun, type regedit, and press ENTER.
    2. Select EditFind, type 6B1D51EC6B91D4D4F834FCD5C23365FF, and click Find Next.
    3. Right-click any matching key found and select Delete.

      NOTE: Delete the parent key if there are no other values in the key.

      See the Related Information section for a full listing of all registry values that should be located and removed in this way.  
  1. Reset Microsoft Outlook Add-in Manager (if Microsoft Outlook is installed)

    This procedure instructs Microsoft Outlook to rebuild the EXTEND.DAT for the next user to open Outlook, removing references to the VirusScan Email Scan add-in.
  1. Click StartRun, type regedit, and click OK.
  2. Locate the following registry location:

    HKEY_LOCAL_MACHINE\SOFTWARE\Software\Microsoft\Exchange\Client\Extensions
     
  3. Right-click the Extensions key and select NewString Value.
  4. Rename the new value to Outlook Setup Extension and press ENTER.
  5. Right-click Outlook Setup Extension and select Modify.
  6. In the Value Data field, type 4.0;Outxxx.dll;7;00000000000000;0000000;OutXXX and press ENTER.

Solution 3

Manual removal procedure for VirusScan Enterprise (VSE) 8.8i (64-bit installations)
The 32-bit instructions apply with the exception of the following:
  • 64-bit directory structure
    Replace C:\Program Files\...  with C:\Program Files (x86)\...
     
  • 64-bit registry locations
    Replace HKEY_LOCAL_MACHINE\Software\McAfee with HKEY_LOCAL_MACHINE\Software\Wow6432Node\McAfee

Rate this document

Did this article resolve your issue?

Please provide any comments below

Glossary of Technical Terms


Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.
United States - English
© 2003-2013 McAfee, Inc.