How to manually remove VirusScan Enterprise 8.5i

03/26/2020 5 12900

DESCRIPTION:

How to manually remove VirusScan Enterprise 8.5i.

A notice has been issued for SonicWall Enforced Client's (McAfee and Kaspersky). Please see Notice: End of Support for SonicWall Enforced Client for more information.

RESOLUTION:

Environment

McAfee VirusScan Enterprise 8.5i

Microsoft Windows (all supported versions)

Summary

Manual removal instructions for VirusScan Enterprise 8.5i

Solution

IMPORTANT:

• The following instructions are intended to be used as a last resort for removing VirusScan Enterprise 8.5i. Before attempting a manual removal, try all other methods first. Administrators should use discretion when employing this solution.
• This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, see the following Microsoft Knowledge Base article: http://support.microsoft.com/kb/256986/EN-US/ .

STEP 1 - Remove Common Management Agent (CMA) reference for VirusScan Enterprise (if applicable).

1. Click Start, Run.
2. Type: <CMA install folder>FRMINST.exe /REMOVE=Updater /PRODUCT=Viruscan8600, and click OK.
   
   IMPORTANT: The product designation for VSE 8.5i is Virusscan8600, not Virusscan8500.
   
   Example: C:Program FilesMcAfeeCommon Frameworkfrminst.exe /remove=updater /product=Viruscan8600
   
   

   NOTE: The default location for the CMA installation folder is: C:\Program Files\McAfeeCommon\Framework.

STEP 2 - Unregister with Checkpoint. (if applicable).

1. Click Start, Run.
2. Type: <VirusScan install folder>PIREG.EXE /d <VirusScan install folder>MCAVSCV.DLL, and click OK.
   
   NOTE: The default location for the VirusScan installation folder is: C:Program FilesMcAfeeVirusScan Enterprise.

STEP 3 - Remove the Anti-Spyware Module (if installed).

1. Click Start, Run.
2. Type: <VirusScan install folder>CSSCAN.exe /UninstallMAS, and click OK.

STEP 4 - Remove Lotus Scanner(if applicable).

1. Click Start, Run.
2. Type: <VirusScan install folder>NCDAEMON.exe -remove and click OK.

STEP 5 - Delete Registry Keys - Part 1.

1. Click Start, Run, type regedit and click OK.
2. Navigate to each of the following keys, right-click each key, and select Delete:

• [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Products40C30C53F1F32C249A987A75EE96F156
• [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUpgradeCodes
  9FF15957780018945A6265BC95AD719D]
• [HKEY_CLASSES_ROOTInstallerProducts40C30C53F1F32C249A987A75EE96F156]
• [HKEY_CLASSES_ROOTInstallerFeatures40C30C53F1F32C249A987A75EE96F156]
• [HKEY_CLASSES_ROOTInstallerUpgradeCodes9FF15957780018945A6265BC95AD719D ]

STEP 6 - Unload vsplugin.dll (if ePolicy Orchestrator Agent is installed).

1. Navigate to the following registry location:
   
   [HKEY_LOCAL_MACHINESOFTWARENetwork AssociatesePolicy Orchestrator
   Application PluginsViruScan8600]
2. Right-click the key ViruScan8600.
3. Select New, DWORD Value.
4. Rename the New Value #1 value to Plugin Flag and press Enter.
5. Right-click Plugin Flag and select Modify
6. In the Value Data field type 8 and click OK.

STEP 7 - Stop VirusScan Services.

IMPORTANT: Your system will be unprotected after this step. For security, you may wish to continue working while disconnected from the network.

From the VirusScan Console disable Access Protection.

1. To open the VirusScan Console, from the Start menu - click Start, Programs, Mcafee.
2. Select VirusScan Console.
3. Right-click Access Protection, and select Disable.
4. Exit the VirusScan Console.
5. Click Start, Run, type NET STOP McShield, and click OK.
6. Click Start, Run, type NET STOP McTaskManager, and click OK.

STEP 8 - Delete Registry Keys - Part 2.

1. Search the Windows Registry for and delete instances of 40C30C53F1F32C249A987A75EE96F156:
2.  
   1. Click Start, Run, type regedit and click OK.
   2. Select Edit, Find, type: 40C30C53F1F32C249A987A75EE96F156 and click Find Next.
   3. Right-click any matching key found and select Delete.
      
      NOTE : Delete the parent key if there are no other values in the key.
       

STEP 9 - Delete VirusScan Services.

1. Navigate to and select the following registry key:
   
   [HKEY_LOCAL_MACHINESystemControlSet001ServicesMcShield]
2. Right-click the key and select New, DWORD Value .
3. Rename the New Value #1 value to DeleteFlag and press Enter.
4. Right-click DeleteFlag and select Modify
5. In the Value Data field type 1.
6. Create another new DWORD value named VSEFlag and change the Value Data to 1.
7. Navigate to the following registry location:
   
   [HKEY_LOCAL_MACHINESystemControlSet001ServicesMcTaskManager]
8. Create a DWORD value named DeleteFlag with a value of 1.
9. Create a DWORD value named VSEFlag with a value of 1.

STEP 10 - Uninstall VirusScan Drivers.

1. Select Start, Run, type cmd and press Enter.
2. Navigate to the VirusScan installation folder.
   
   Example: cd program filesmcafeevirusscan enterprise
3. Type: mfehidin.exe -u mfeavfk.sys mfeapfk.sys mfebopk.sys mfehidk.sys mfetdik.sys

STEP 11 - Unregister DLLs

1. Select Start, Run, type cmd and press Enter.

Navigate to the VirusScan installation folder.

NOTE: By default, the VirusScan install folder is: C:Program FilesMcAfeeVirusScan Enterprise.

1. Type each of the following commands and press Enter after each:  
   • regsvr32.exe /u SCRIPTCL.dll
   • regsvr32.exe /u x64SCRIPTCL.dll (for 64-bit systems only)
   • regsvr32.exe /u VSUPDATE.dll

STEP 12 - Delete Registry Keys - Part 3.

1. Click Start, Run, type regedit and click OK.
2. Navigate to each of the following registry keys, right-click each key, and select Delete:
   • [HKEY_CLASSES_ROOTCLSID{cda2863e-2497-4c49-9b89-06840e070a87}]
   • [HKEY_CLASSES_ROOTDirectoryshellexContextMenuHandlersVirusScan]
   • [HKEY_CLASSES_ROOTFoldershellexContextMenuHandlersVirusScan]
   • [HKEY_CURRENT_USERSoftwareMcAfeeDesktopProtection]
   • [HKEY_LOCAL_MACHINESOFTWAREMcAfeeAVEngine]
   • [HKEY_LOCAL_MACHINESOFTWAREMcAfeeDesktopProtection]
   • [HKEY_LOCAL_MACHINESOFTWAREMcAfeeVSCore]
   • [HKEY_LOCAL_MACHINESOFTWAREMcAfeeePolicy OrchestratorApplication PluginsVIRUSCAN8600]
   • [HKEY_LOCAL_MACHINESOFTWARENetwork AssociatesePolicy OrchestratorApplication PluginsVIRUSCAN8600]
   • [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall{35C03C04-3F1F-42C2-A989-A757EE691F65}]
   • [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun], ShStatEXE
   • [HKEY_LOCAL_MACHINESOFTWAREControlSet001ServicesEventlogApplicationMcLogEvent]
   • [HKEY_CLASSES_ROOT*shellexContextMenuHandlersVirusScan]
3. Restart your system.

STEP 13 - Delete Files/Folders.

1. Delete each of the following program folders:

• C:Documents and SettingsAll UsersStart MenuProgramsMcAfee
• C:Program FilesCommon FilesNetwork AssociatesEngine
• C:Documents and SettingsAll UsersApplication DataMcAfeeDesktopProtection
• C:Program FilesMcAfeeVirusScan Enterprise
• C:Program FilesCommon FilesMcAfeeEngine
• C:WINDOWSInstaller{35C03C04-3F1F-42C2-A989-A757EE691F65}

1. Delete each of the following folders if empty:

1. • C:Documents and SettingsAll UsersApplication DataMcAfee
   • C:Program FilesCommon FilesMcAfee
   • C:Program FilesMcAfee
2. Locate and delete the appropriate MSI file(s):
3. Navigate to C:WindowsInstaller<random name>.msi
4. Right-click each file, select Properties and Summary to view the application it belongs to.
5. If the summary states VirusScan, delete the file.

STEP 14 - Reset Microsoft Outlook Add-in Manager (if Microsoft Outlook is installed).

This step instructs Microsoft Outlook to rebuild the EXTEND.DAT for the next user to open Outlook, removing references to the VirusScan Email Scan add-in.

1. Click Start, Run, type regedit and click OK.
2. Navigate to and select the following registry location:
   
   [HKEY_LOCAL_MACHINESOFTWARESoftwareMicrosoftExchangeClientExtensionsOutlook Setup Extension]
3. Right-click the Extensions key and select New, String Value.
4. Rename the new value to Outlook Setup Extension and press Enter.
5. Right-click Outlook Setup Extension and select Modify
6. In the Value Data field type:
   
   4.0;Outxxx.dll;7;00000000000000;0000000;OutXXX

Related Information

These are the additional registry entries which should be removed during step 8 of the solution:

• [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components0B150AC107B12D11A9DD0006794C4E25],40c30c53f1f32c249a987a75ee96f156
• [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components2C4BAACEE3FF058449CFE4DABB1FD9A4]
• [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components00534BDFF73EF4741B9DE248FF053E6B]
• [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ComponentsD39367440CD903246B90B55051833FBC]
• [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ComponentsDAD3EF0BB0183DC499FD529DE6BFFAB3]
• [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components49C7DFA9451919B4A9CED1290A8D9EE5]
• [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components929FD1A3CAC6F474BBB9ADF8995BA8EC]
• [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components115C8E035990C514EB3FC746A5515577]
• [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components46383276227F4BB4D8073