TechSpot

How to completely remove Mcafee?

By pmolson
Jul 7, 2006
  1. I've uninstalled mcafee, in order to install panda 2006 (and try it). The problem is when I try to install Panda is says I still have mcafee an that I need to 1st uninstall it. Any idea how to complete remove this sucker? Note that in add/remove program there is no more mcafee, I also tried to manually remove some regkeys that referenced mcafee, but to no avail…lastly I've tried reinstalling mcafee, but 1/2-way through the installation, it says mcafee encountered an error. No other specifics are given…

    Any suggestion/help would be appreciate it….THX
     
  2. TypeX45

    TypeX45 TS Rookie Posts: 216

    You might have to remove the agent link to mcafee

    "C:\Program Files\Network Associates\Common Framework\FrmInst.exe" /remove=agent

    Do this in safe mode to. Also while in safe mode reomve all of its compents if you have not done so already
     
  3. mailpup

    mailpup TS Special Forces Posts: 8,462   +229

    On the McAfee site there is a utility that might help you to remove VirusScan. Click here to find it. Find the link that says "How do I uninstall VirusScan?" Then find the link to download the file called "VSCleanupTool.exe"
     
  4. korrupt

    korrupt TS Rookie Posts: 1,060

    Try to remove the whole mccafee folder in Program files.

    Regards,

    Korrupt
     
  5. pmolson

    pmolson TS Rookie Topic Starter

    Thanks Guys....strating pc in safe mode and removing mcafee files worked just fine!
     
  6. pgt

    pgt TS Rookie

    Official solution

    Corporate KnowledgeBase ID: KB58597
    Published: January 29, 2009

    Environment
    Microsoft Windows (All supported versions. See KB51109)
    Summary
    This article outlines how can VirusScan Enterprise 8.0i can be manually removed if an automatic removal is unsuccessful?
    Solution 1

    Use MSIEXEC.EXE to remove remnants (When Add/Remove programs option is not available).

    In some cases it is possible to remove VirusScan Enterprise remnants using the MSIEXEC.EXE with the products installation string.
    This can save time and is recommended before undertaking the manual uninstall procedure.

    For full full details on how to remove VirusScan Enterprise via the command line using msiexec.exe, see KB52648.
    Solution 2

    IMPORTANT: The following instructions are intended to be used as a last resort for removing VirusScan Enterprise. Before attempting a manual removal, try all other methods first. Administrators should use discretion when employing this solution.

    CAUTION: This article contains information about opening or modifying the registry.

    * The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
    * Before proceeding, McAfee strongly recommends backing up your registry and understanding the restore process. For more information, see: support.microsoft.com/kb/256986
    * Do not run a .REG file that is not confirmed to be a genuine registry import file.



    Manual removal procedure.

    Stop and Disable running McAfee and other services:

    1. Click Start, Run, type services.msc and click OK.
    2. Right-click McAfee Framework and select Stop.
    3. For each of the following services, right-click, select Properties, set the Startup type to Disabled, click Stop, and click OK.

    Network Associates McShield (McShield.exe)
    Network Associates Task Manager (VsTskMgr.exe)


    4. If Simple Network Management Protocol (SNMP) service is running it will lock the VSE80i Mcvssnmp.dll. To unlock the file and allow it to be deleted please stop the following services

    SNMP Service
    SNMP Trap Service


    Remove components:

    1. Click Start, Run, type cmd and click OK.
    2. Change directory to: \Program Files\Common Files\Network Associates\Talkback.
    Type TBMON -Delref and hit Enter to decrement the counter for the McAfee Error Reporting Service.
    3. Change directory to: \Program Files\Network Associates\VirusScan.
    4. Type Naiavfin -u and press Enter to flag the McAfee Filter (naiavfnx.sys) and TDI (mvstdinx.sys) drivers for removal after a system restart.
    5. Change directory to: \Program Files\Network Associates\Common Framework.
    6. Type Frminst /remove=updater and press Enter to decrement the counter for the Common Framework service.
    7. Change directory to: \Program Files\Network Associates\VirusScan.
    8. Type Regsvr32 /u Scriptproxy.dll and hit Enter to unregister the .DLL for Script Scanning.
    9. If the McAfee AntiSpyware Enterprise Module 8.0 is installed, type CSSCAN /UninstallMAS and press Enter to remove it.


    Delete registry values:

    1. Click Start, Run, type regedit and click OK.
    2. Navigate to [HKEY_CLASSES_ROOT\*\ShellEx\ContextMenuHandlers\VirusScan].
    3. Right-click the VirusScan key and select Delete.
    4. Navigate to [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run].
    5. Right-click the value ShStatEXE and select Delete.
    6. Restart your computer.

    NOTE: At this time, VirusScan Enterprise (VSE) components are no longer running and your system is unprotected. For security, you may want to disconnect from your network to continue working.

    Remove Registry Keys:

    1. Click Start, Run, type regedit and click OK.
    2. Select Edit, Find.
    3. Delete language dependent registry key:

    For VSE 8.0i English, type BB1D3FD5E498DCD4285751A99C28B934
    For VSE 8.0i German, type B1D6580FEE1125641847AE3F5DBAC666
    For VSE 8.0i Japanese, type 2CE70B0B82FF434458D8D84333E8734F


    4. Click Find Next.
    5. Delete any matching entries found.
    6. Repeat until no further entries are found.
    7. Navigate to each of the following keys, right-click each, and select Delete:

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\McShield]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\McTaskManager]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NaiAvFilter1]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NaiAvFilter10n] (where n is any number]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EntDrvnn] (where nn is any number)
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NaiAvTdi1]
    [HKEY_LOCAL_MACHINE\Software\Network Associates\Epolicy Orchestrator\Application Plugins\VIRUSCAN8000]
    [HKEY_LOCAL_MACHINE\Software\Network Associates\TVD\Shared Components\Alert Client\VSE]
    [HKEY_LOCAL_MACHINE\Software\Network Associates\TVD\Shared Components\Detect]
    [HKEY_LOCAL_MACHINE\Software\Network Associates\TVD\Shared Components\Entercept]
    [HKEY_LOCAL_MACHINE\Software\Network Associates\TVD\Shared Components\McPAL]
    [HKEY_LOCAL_MACHINE\Software\Network Associates\TVD\Shared Components\McVSSNMP]
    [HKEY_LOCAL_MACHINE\Software\Network Associates\TVD\Shared Components\NVP]
    [HKEY_LOCAL_MACHINE\Software\Network Associates\TVD\Shared Components\On Access Scanner]
    [HKEY_LOCAL_MACHINE\Software\Network Associates\TVD\Shared Components\On Demand Scanner]
    [HKEY_LOCAL_MACHINE\Software\Network Associates\TVD\Shared Components\VirusScan Engine]
    [HKEY_LOCAL_MACHINE\Software\Network Associates\TVD\VirusScan Enterprise]

    For VSE 8.0i English:
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{5DF3D1BB-894E-4DCD-8275-159AC9829B43}]
    For VSE 8.0i German delete,
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F0856D1B-11EE-4652-8174-EAF3D5AB6C66}]


    If the AntiSpyware Enterprise Module was installed then delete:
    [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator\Application Plugins\VSEMAS__8000]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\McAfee Anti-Spyware Enterprise Module]


    8. Navigate to the following keym then right-click the value Exchange Scan and select Delete. :
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Extensions]


    9. Navigate to the following key, then right-click the value C:\WINDOWS\System32\EntAPI.dll, and select Delete.
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]



    Remove Directory Structure:

    Use Windows Explorer to navigate to each of the following folders. Right click each, and select Delete:

    \Program files\Network Associates\VirusScan
    \Program files\Common files\Network Associates\Engine
    \Documents and Settings\All Users\Start Menu\Programs\Network Associates
    \Documents and settings\All Users\Application Data\Network Associates\BOPDATA
    \Documents and settings\All Users\Application Data\Network Associates\VirusScan

    Remove Files:

    1. Use Windows Explorer to navigate to C:\WINDOWS\System32.
    2. Right-click EntAPI.dll and select Delete.
    3. Navigate to C:\WINDOWS\System32\Drivers.
    4. Locate the following files, right-click each one and select Delete.

    MVSTDInn.SYS
    NAIAVFnn.SYS
    EntDrvnn.SYS

    NOTE: nn will be two alphanumeric characters such as 5x.

    If the Lotus Notes Client is installed:

    1. Open each copy of NOTES.INI and remove the following two lines:

    AddInMenus=NCMenu
    EXTMGR_ADDINS=NCExtMgr


    2. Delete the following files from the Lotus Notes Program Files folder (default is C:\Program Files\Lotus\Notes)

    NCInstall.dll
    NCDaemon.exe
    NCTrace.dll
    NCScan.dll
    NCExtMgr.dll
    NCMenu.dll


    McAfee recommends the following to ensure a complete cleanup of VirusScan Enterprise:

    Empty all files from the following TEMP folders:

    C:\Documents and Settings\<User>\Local Settings\Temp
    C:\WINDOWS\Temp


    Remove previous .MSI file:

    1. Navigate to C:\WINDOWS\Installer.
    2. Right-click each.MSI file and select Properties. If the Summary tab displays VirusScan, then click OK, right-click the file and select Delete.



    Remove the VirusScan Enterprise icons folder:

    1. Navigate to C:\WINDOWS\Installer\.

    For VSE 8.0i English Right click the {5DF3D1BB-894E-4DCD-8275-159AC9829B43} folder and select Delete.
    For VSE 8.0i German, Right click the {F0856D1B-11EE-4652-8174-EAF3D5AB6C66} folder and select Delete.
    For VSE 8.0i Japanese, Right click the {B0B07EC2-FF28-4434-858D-8D34338E37F4} folder and select Delete.

    2. Restart your computer.


    NOTE: These steps do not include instruction for removing the McAfee Error Reporting Service and Common Framework Service as these components may be shared with other McAfee products.
    Related Information
    KB50602 - How to manually uninstall VirusScan Enterprise 8.5i
    Previous Document ID
    KB47372
     
  7. kimsland

    kimsland Ex-TechSpotter Posts: 18,353

    Or just do this ;)

    Run the McAfee Removal Tool

    But thanks for reviving a 3 year old thread though :confused:
     
  8. pgt

    pgt TS Rookie

    I was desperately searching for this kb as most of the forums has the old kb number and link.

    Thought it would help someone :)

    Removal tool wont remove enterprise edition. This kb is for enterprise.

    Cheers
     
  9. Gossioii2

    Gossioii2 TS Rookie

    good

    I feel good that there are people like you too. Thanks for this great weblog of yours. Its surely going to get me to go to higher places!
     
  10. davisjaron

    davisjaron TS Member Posts: 79

    or go down to your local geeksquad (in bestbuy) and they will take it off your computer with a verified McAfee removal tool for free...
     
  11. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    One short note: most programs, especially security programs won't uninstall if they are running. and since they are set to run on Startup, going into Safe Mode, using the msconfig utility to uncheck all the related entries, usually make the uninstall work.
     
     
  12. captaincranky

    captaincranky TechSpot Addict Posts: 10,833   +925

    Yeah.....,What Kimsland Said..........

    Why not go to this Macafee page, download "MCPR.exe" and run it.

    Here's a hint "MCPR" is an acronym for, "Macafee Consumer Products Removal".

    The page alludes to the fact that this is not foolproof. That having been said..........it's still worth a shot. :rolleyes:

    Once upon a time they sold T-shirts that said, "I'm a virgin, but this is as very old shirt". All we need do here is to substitute, "thread" for shirt. Oh well, you get the idea.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.