Main Menu
  • COMPANY
    • Boundless Cybersecurity
    • Press Releases
    • News
    • Events
    • Awards
    • Leadership
    • Press Kit
    • Careers
  • PROMOTIONS
    • SonicWall Promotions
    • Customer Loyalty Program
  • MANAGED SERVICES
    • Managed Security Services
    • Security as a Service
    • Professional Services
SonicWall
  • Products
      All Products A–Z
      Free Trials
    • Network Security
      • Next-Generation Firewall (NGFW)
      • Network Security Services
      • Network Security Management
      • Secure SD-WAN
    • Threat Protection
      • Advanced Threat Protection Cloud
      • Advanced Threat Protection Appliance
      • Capture Labs
    • Secure Access Service Edge (SASE)
      • Zero-Trust Network Access (ZTNA)
    • Cloud Security
      • Cloud Firewall
      • Cloud App Security
    • Endpoint Security
      • Endpoint Detection & Response (EDR)
    • Email Security
      • Cloud Email Security
      • Hosted Email Security
      • On-Prem Email Security
    • Secure Access
      • Wireless Access Points
      • Network Switch
      • Virtual Private Network (VPN)
    • Wi-Fi 6 Access Points

      SonicWall SonicWave 600 series access points provide always-on, always-secure connectivity for complex, multi-device environments.

      Read More
  • Solutions
    • Industries
      • Distributed Enterprises
      • Retail & Hospitality
      • K-12 Education
      • Higher Education
      • State & Local
      • Federal
      • Healthcare
      • Financial Services
      • Carriers
    • Use Cases
      • Secure SD-Branch
      • Network Segmentation
      • Zero Trust Security
      • Secure SD-WAN
      • Office 365 Security
      • SaaS Security
      • Secure Wi-Fi
    • Solutions Widgets
      • Solutions Content Widgets
        Federal

        Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions

      • Solutions Image Widgets
  • Partners
    • SonicWall Partners
      • Partners Overview
      • Find a Partner
      • Authorized Distributors
      • Technology Partners
    • Partner Resources
      • Become a Partner
      • SonicWall University
      • Training & Certification
    • Partner Widgets
      • Custom HTML : Partners Content WIdgets
        Partner Portal

        Access to deal registration, MDF, sales and marketing tools, training and more

      • Partners Image Widgets
  • Support
    • Support
      • Support Portal
      • Knowledge Base
      • Technical Documentation
      • Community
      • Video Tutorials
      • Product Life Cycle Tables
      • Partner Enabled Services
      • Contact Support
    • Resources
      • Resource Center
      • Events
      • Free Trials
      • Blog
      • SonicWall University
      • MySonicWall
    • Capture Labs
      • Capture Labs
      • Security Center
      • Security News
      • PSIRT
      • Application Catalog
    • Support Widget
      • Custom HTML : Support Content WIdgets
        Support Portal

        Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials

      • Support Image Widgets
  • COMPANY
    • Boundless Cybersecurity
    • Press Releases
    • News
    • Events
    • Awards
    • Leadership
    • Press Kit
    • Careers
  • PROMOTIONS
    • SonicWall Promotions
    • Customer Loyalty Program
  • MANAGED SERVICES
    • Managed Security Services
    • Security as a Service
    • Professional Services
  • Contact Sales
  • English English English en
  • BLOG
  • CONTACT SALES
  • FREE TRIALS
  • English English English en
SonicWall
  • Products
      All Products A–Z
      Free Trials
    • Network Security
      • Next-Generation Firewall (NGFW)
      • Network Security Services
      • Network Security Management
      • Secure SD-WAN
    • Threat Protection
      • Advanced Threat Protection Cloud
      • Advanced Threat Protection Appliance
      • Capture Labs
    • Secure Access Service Edge (SASE)
      • Zero-Trust Network Access (ZTNA)
    • Cloud Security
      • Cloud Firewall
      • Cloud App Security
    • Endpoint Security
      • Endpoint Detection & Response (EDR)
    • Email Security
      • Cloud Email Security
      • Hosted Email Security
      • On-Prem Email Security
    • Secure Access
      • Wireless Access Points
      • Network Switch
      • Virtual Private Network (VPN)
    • Wi-Fi 6 Access Points

      SonicWall SonicWave 600 series access points provide always-on, always-secure connectivity for complex, multi-device environments.

      Read More
  • Solutions
    • Industries
      • Distributed Enterprises
      • Retail & Hospitality
      • K-12 Education
      • Higher Education
      • State & Local
      • Federal
      • Healthcare
      • Financial Services
      • Carriers
    • Use Cases
      • Secure SD-Branch
      • Network Segmentation
      • Zero Trust Security
      • Secure SD-WAN
      • Office 365 Security
      • SaaS Security
      • Secure Wi-Fi
    • Solutions Widgets
      • Solutions Content Widgets
        Federal

        Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions

      • Solutions Image Widgets
  • Partners
    • SonicWall Partners
      • Partners Overview
      • Find a Partner
      • Authorized Distributors
      • Technology Partners
    • Partner Resources
      • Become a Partner
      • SonicWall University
      • Training & Certification
    • Partner Widgets
      • Custom HTML : Partners Content WIdgets
        Partner Portal

        Access to deal registration, MDF, sales and marketing tools, training and more

      • Partners Image Widgets
  • Support
    • Support
      • Support Portal
      • Knowledge Base
      • Technical Documentation
      • Community
      • Video Tutorials
      • Product Life Cycle Tables
      • Partner Enabled Services
      • Contact Support
    • Resources
      • Resource Center
      • Events
      • Free Trials
      • Blog
      • SonicWall University
      • MySonicWall
    • Capture Labs
      • Capture Labs
      • Security Center
      • Security News
      • PSIRT
      • Application Catalog
    • Support Widget
      • Custom HTML : Support Content WIdgets
        Support Portal

        Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials

      • Support Image Widgets
  • COMPANY
    • Boundless Cybersecurity
    • Press Releases
    • News
    • Events
    • Awards
    • Leadership
    • Press Kit
    • Careers
  • PROMOTIONS
    • SonicWall Promotions
    • Customer Loyalty Program
  • MANAGED SERVICES
    • Managed Security Services
    • Security as a Service
    • Professional Services
  • Contact Sales
  • Menu

How to manually remove VirusScan Enterprise 8.5i

03/26/2020 5 People found this article helpful 199,660 Views

    Download
    Print
    Share
    • LinkedIn
    • Twitter
    • Facebook
    • Email
    • Copy URL The link has been copied to clipboard

    Description

    How to manually remove VirusScan Enterprise 8.5i.


    A notice has been issued for SonicWall Enforced Client's (McAfee and Kaspersky). Please see Notice: End of Support for SonicWall Enforced Client for more information.

    Resolution

    Environment

    McAfee VirusScan Enterprise 8.5i

    Microsoft Windows (all supported versions)

    Summary

    Manual removal instructions for VirusScan Enterprise 8.5i

    Solution

    IMPORTANT:

    • The following instructions are intended to be used as a last resort for removing VirusScan Enterprise 8.5i. Before attempting a manual removal, try all other methods first. Administrators should use discretion when employing this solution.
    • This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, see the following Microsoft Knowledge Base article: http://support.microsoft.com/kb/256986/EN-US/ .

      

    STEP 1 - Remove Common Management Agent (CMA) reference for VirusScan Enterprise (if applicable).

    1. Click Start, Run.
    2. Type: <CMA install folder>FRMINST.exe /REMOVE=Updater /PRODUCT=Viruscan8600, and click OK.

      IMPORTANT: The product designation for VSE 8.5i is Virusscan8600, not Virusscan8500.

      Example: C:Program FilesMcAfeeCommon Frameworkfrminst.exe /remove=updater /product=Viruscan8600

      NOTE: The default location for the CMA installation folder is: C:\Program Files\McAfeeCommon\Framework.

    STEP 2 - Unregister with Checkpoint. (if applicable).

    1. Click Start, Run.
    2. Type: <VirusScan install folder>PIREG.EXE /d <VirusScan install folder>MCAVSCV.DLL, and click OK.

      NOTE: The default location for the VirusScan installation folder is: C:Program FilesMcAfeeVirusScan Enterprise.

    STEP 3 - Remove the Anti-Spyware Module (if installed).

    1. Click Start, Run.
    2. Type: <VirusScan install folder>CSSCAN.exe /UninstallMAS, and click OK.

    STEP 4 - Remove Lotus Scanner(if applicable).

    1. Click Start, Run.
    2. Type: <VirusScan install folder>NCDAEMON.exe -remove and click OK.

    STEP 5 - Delete Registry Keys - Part 1.

    1. Click Start, Run, type regedit and click OK.
    2. Navigate to each of the following keys, right-click each key, and select Delete:
    • [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Products40C30C53F1F32C249A987A75EE96F156
    • [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUpgradeCodes
      9FF15957780018945A6265BC95AD719D]
    • [HKEY_CLASSES_ROOTInstallerProducts40C30C53F1F32C249A987A75EE96F156]
    • [HKEY_CLASSES_ROOTInstallerFeatures40C30C53F1F32C249A987A75EE96F156]
    • [HKEY_CLASSES_ROOTInstallerUpgradeCodes9FF15957780018945A6265BC95AD719D ]

    STEP 6 - Unload vsplugin.dll (if ePolicy Orchestrator Agent is installed).

    1. Navigate to the following registry location:

      [HKEY_LOCAL_MACHINESOFTWARENetwork AssociatesePolicy Orchestrator

      Application PluginsViruScan8600]
    2. Right-click the key ViruScan8600.
    3. Select New, DWORD Value.
    4. Rename the New Value #1 value to Plugin Flag and press Enter.
    5. Right-click Plugin Flag and select Modify
    6. In the Value Data field type 8 and click OK.

    STEP 7 - Stop VirusScan Services.

    IMPORTANT: Your system will be unprotected after this step. For security, you may wish to continue working while disconnected from the network.

    From the VirusScan Console disable Access Protection.

    1. To open the VirusScan Console, from the Start menu - click Start, Programs, Mcafee.
    2. Select VirusScan Console.
    3. Right-click Access Protection, and select Disable.
    4. Exit the VirusScan Console.
    5. Click Start, Run, type NET STOP McShield, and click OK.
    6. Click Start, Run, type NET STOP McTaskManager, and click OK.

    STEP 8 - Delete Registry Keys - Part 2.

    1. Search the Windows Registry for and delete instances of 40C30C53F1F32C249A987A75EE96F156:
    2.  
      1. Click Start, Run, type regedit and click OK.
      2. Select Edit, Find, type: 40C30C53F1F32C249A987A75EE96F156 and click Find Next.
      3. Right-click any matching key found and select Delete.

        NOTE : Delete the parent key if there are no other values in the key.
         

    STEP 9 - Delete VirusScan Services.

    1. Navigate to and select the following registry key:

      [HKEY_LOCAL_MACHINESystemControlSet001ServicesMcShield]
    2. Right-click the key and select New, DWORD Value .
    3. Rename the New Value #1 value to DeleteFlag and press Enter.
    4. Right-click DeleteFlag and select Modify
    5. In the Value Data field type 1.
    6. Create another new DWORD value named VSEFlag and change the Value Data to 1.
    7. Navigate to the following registry location:

      [HKEY_LOCAL_MACHINESystemControlSet001ServicesMcTaskManager]
    8. Create a DWORD value named DeleteFlag with a value of 1.
    9. Create a DWORD value named VSEFlag with a value of 1.

    STEP 10 - Uninstall VirusScan Drivers.

    1. Select Start, Run, type cmd and press Enter.
    2. Navigate to the VirusScan installation folder.

      Example: cd program filesmcafeevirusscan enterprise
    3. Type: mfehidin.exe -u mfeavfk.sys mfeapfk.sys mfebopk.sys mfehidk.sys mfetdik.sys

    STEP 11 - Unregister DLLs

    1. Select Start, Run, type cmd and press Enter.

    Navigate to the VirusScan installation folder.

    NOTE: By default, the VirusScan install folder is: C:Program FilesMcAfeeVirusScan Enterprise.

    1. Type each of the following commands and press Enter after each:  
      • regsvr32.exe /u SCRIPTCL.dll
      • regsvr32.exe /u x64SCRIPTCL.dll (for 64-bit systems only)
      • regsvr32.exe /u VSUPDATE.dll

    STEP 12 - Delete Registry Keys - Part 3.

    1. Click Start, Run, type regedit and click OK.
    2. Navigate to each of the following registry keys, right-click each key, and select Delete:
      • [HKEY_CLASSES_ROOTCLSID{cda2863e-2497-4c49-9b89-06840e070a87}]
      • [HKEY_CLASSES_ROOTDirectoryshellexContextMenuHandlersVirusScan]
      • [HKEY_CLASSES_ROOTFoldershellexContextMenuHandlersVirusScan]
      • [HKEY_CURRENT_USERSoftwareMcAfeeDesktopProtection]
      • [HKEY_LOCAL_MACHINESOFTWAREMcAfeeAVEngine]
      • [HKEY_LOCAL_MACHINESOFTWAREMcAfeeDesktopProtection]
      • [HKEY_LOCAL_MACHINESOFTWAREMcAfeeVSCore]
      • [HKEY_LOCAL_MACHINESOFTWAREMcAfeeePolicy OrchestratorApplication PluginsVIRUSCAN8600]
      • [HKEY_LOCAL_MACHINESOFTWARENetwork AssociatesePolicy OrchestratorApplication PluginsVIRUSCAN8600]
      • [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall{35C03C04-3F1F-42C2-A989-A757EE691F65}]
      • [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun], ShStatEXE
      • [HKEY_LOCAL_MACHINESOFTWAREControlSet001ServicesEventlogApplicationMcLogEvent]
      • [HKEY_CLASSES_ROOT*shellexContextMenuHandlersVirusScan]
    3. Restart your system.

    STEP 13 - Delete Files/Folders.

    1. Delete each of the following program folders:
    • C:Documents and SettingsAll UsersStart MenuProgramsMcAfee
    • C:Program FilesCommon FilesNetwork AssociatesEngine
    • C:Documents and SettingsAll UsersApplication DataMcAfeeDesktopProtection
    • C:Program FilesMcAfeeVirusScan Enterprise
    • C:Program FilesCommon FilesMcAfeeEngine
    • C:WINDOWSInstaller{35C03C04-3F1F-42C2-A989-A757EE691F65}
    1. Delete each of the following folders if empty:

     

      • C:Documents and SettingsAll UsersApplication DataMcAfee
      • C:Program FilesCommon FilesMcAfee
      • C:Program FilesMcAfee
    1. Locate and delete the appropriate MSI file(s):
    2. Navigate to C:WindowsInstaller<random name>.msi
    3. Right-click each file, select Properties and Summary to view the application it belongs to.
    4. If the summary states VirusScan, delete the file.

    STEP 14 - Reset Microsoft Outlook Add-in Manager (if Microsoft Outlook is installed).

    This step instructs Microsoft Outlook to rebuild the EXTEND.DAT for the next user to open Outlook, removing references to the VirusScan Email Scan add-in.

    1. Click Start, Run, type regedit and click OK.
    2. Navigate to and select the following registry location:

      [HKEY_LOCAL_MACHINESOFTWARESoftwareMicrosoftExchangeClientExtensionsOutlook Setup Extension]
    3. Right-click the Extensions key and select New, String Value.
    4. Rename the new value to Outlook Setup Extension and press Enter.
    5. Right-click Outlook Setup Extension and select Modify
    6. In the Value Data field type:

      4.0;Outxxx.dll;7;00000000000000;0000000;OutXXX

    Related Information

    These are the additional registry entries which should be removed during step 8 of the solution:

    • [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components0B150AC107B12D11A9DD0006794C4E25],40c30c53f1f32c249a987a75ee96f156
    • [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components2C4BAACEE3FF058449CFE4DABB1FD9A4]
    • [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components00534BDFF73EF4741B9DE248FF053E6B]
    • [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ComponentsD39367440CD903246B90B55051833FBC]
    • [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ComponentsDAD3EF0BB0183DC499FD529DE6BFFAB3]
    • [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components49C7DFA9451919B4A9CED1290A8D9EE5]
    • [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components929FD1A3CAC6F474BBB9ADF8995BA8EC]
    • [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components115C8E035990C514EB3FC746A5515577]
    • [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18Components46383276227F4BB4D8073

    Related Articles

    • Bandwidth usage and tracking in SonicWall
    • How to force an update of the Security Services Signatures from the Firewall GUI
    • Configure Guest VLAN in the TZ firewall, for guest users to access Internet only.

    Categories

    • Firewalls > TZ Series
    • Firewalls > SonicWall SuperMassive E10000 Series
    • Firewalls > SonicWall SuperMassive 9000 Series
    • Firewalls > SonicWall NSA Series

    Not Finding Your Answers?

    ASK THE COMMUNITY

    Was This Article Helpful?

    YESNO

    Article Helpful Form

    Article Not Helpful Form

    Company
    • Careers
    • News
    • Leadership
    • Awards
    • Press Kit
    • Contact Us
    Popular resources
    • Communities
    • Blog
    • SonicWall Capture Labs

    Stay In Touch

    • By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement. You can unsubscribe at any time from the Preference Center.
    • This field is for validation purposes and should be left unchanged.
    • Facebook
    • Twitter
    • Linkedin
    • Youtube
    • Instagram

    © 2023 SonicWall. All Rights Reserved.

    • Legal
    • Privacy
    • English
    Scroll to top