×
INTELLIGENT WORK FORUMS
FOR COMPUTER PROFESSIONALS

Contact US

Log In

Come Join Us!

Are you a
Computer / IT professional?
Join Tek-Tips Forums!
  • Talk With Other Members
  • Be Notified Of Responses
    To Your Posts
  • Keyword Search
  • One-Click Access To Your
    Favorite Forums
  • Automated Signatures
    On Your Posts
  • Best Of All, It's Free!

*Tek-Tips's functionality depends on members receiving e-mail. By joining you are opting in to receive e-mail.

Posting Guidelines

Promoting, selling, recruiting, coursework and thesis posting is forbidden.

Students Click Here

Security, hacker detection & forensics FAQ

Virus

Manual uninstallation of VirusScan by b5passat
Posted: 3 Jun 02

Windows NT/2000

If the installation of the new product will not run after uninstalling the previous version, delete all the files in the Winnt\Temp, and the \Temp directory (be aware that many people store "working" files in here so it is best to check with the user to see if there is anything required contained here). Try running the installation once again after the files have been deleted. If the install still will not proceed, continue on to the instructions below.

The following instructions involve making modifications to the registry of the machine. Please make sure all necessary files that might be stored locally on the hard drive have been backed up, and that you have a current emergency repair disk for the machine that you are working on.

Begin by installing the Microsoft Windows Installer Cleanup Utility for Windows NT/2000. Save the file to the local hard disk and install by double clicking on the saved file. To run the Cleanup Utility, find the entry that was added to the Programs menu and run the only menu item that is associated with it. This program has nothing to do with the cleanup of the Network Associates product, it is only cleaning the remnants of the Windows Installer.

See below in the Windows 9x section for registry keys that should be deleted if they still exist. Most of the keys found below will pertain only to Windows 9x machines but similar occurences can be found under NT machines and should be removed.

 

Windows 9x

If the installation of the new product will not run after uninstalling the previous version, delete all the files in Windows\Temp, and the \Temp directories (be aware that many people store "working" files in here so it is best to check with the user to see if there is anything required contained here). Close all programs, and press CTRL-ALT-DEL, select everything in the list one by one with the exception of Explorer and Systray, and select 'End Task.' After all the tasks have been ended, try running the installation again. If the install still will not proceed, continue on to the instructions below.

The following instructions involve making modifications to the registry of the machine. Please make sure all necessary files that might be stored locally on the hard drive have been backed up.

Begin by installing the Microsoft Windows Installer Cleanup Utility for Windows 9x. Save the file to the local hard disk and install by double clicking on the saved file. To run the Cleanup Utility, find the entry that was added to the Programs menu and run the only menu item that is associated with it. This program has nothing to do with the cleanup of the Network Associates product, it is only cleaning the remnants of the Windows Installer.

Windows 9x Manual Uninstall
To remove VirusScan without using the uninstall utility, follow these steps: (Some of the steps may not apply. Just proceed to the next).

1. Remove references to VirusScan from your AUTOEXEC.BAT and your SYSTEM.INI files. To do so, follow these steps:

A. Start the Windows system editor. Click Start in the Windows taskbar, then choose Run. Type SYSEDIT in the Run dialog box, then click OK.

A set of text files will open on your screen. Your AUTOEXEC.BAT file should appear as the first or topmost window in this set. Locate and delete the text of each line in the AUTOEXEC.BAT file that refers to VirusScan. Be sure also to delete @IF ERRORLEVEL 1 PAUSE if it appears in the file.

B. Click the title bar for the SYSTEM.INI window to bring it to the foreground, then locate this line: [boot]SCRNSAVE.EXE=C:\PROGRA~1\NETWOR~1\MCAFEE~1\SCRSCAN.EXE

C. Change the line to read: [boot]SCRNSAVE.EXE=C:\WINDOWS\SYSTEM\WINDOW~1.SCR

D. When you have restored your SYSTEM.INI file to its original state, choose Save from the SYSEDIT File menu to save your changes, then choose Exit from the File menu to quit the SYSEDIT application.

2. Remove VirusScan icons from the Start menu. To do this, follow these steps:

A. Click Start in the Windows taskbar, point to Settings, then choose Taskbar.

B. Click the Start Menu Programs tab.

C. Click the Remove button.

D. Select the McAfee VirusScan folder in the list that appears in the Remove Shortcuts/Folders dialog box, then click Remove.

E. Windows will ask you to confirm your action. Click Yes to continue.

F. Click Close to close the Remove Shortcuts/Folders dialog box, then click OK to close the Taskbar Properties dialog box.

3. Edit the Registry. To do this, follow these steps:

A. Start the Windows Registry editor. Click Start in the Windows taskbar, then choose Run. Type REGEDIT in the Run dialog box, then click OK.

B. Click + to expand the HKEY_LOCAL_MACHINE folder, click + again to expand the SOFTWARE folder, then click one more time to expand the CLASSES folder. Next, delete these keys or entries:

\.vsc

\.vsh

\CLSID\{9EF56D61-A50F-11ce-B105-0000C04B2D52}

\CLSID\{9EF56D61-A50F-11ce-B105-0000C04B2D52}\InProcServer32

\CLSID\{C88249A0-AD7E-11cf-AD53-444553540000}

\CLSID\{C88249A0-AD7E-11cf-AD53-444553540000}\InProcServer32

\comfile\shell\VirusScan

\Directory\shell\VirusScan

\Drive\shell\VirusScan

\Excel.Addin\shell\VirusScan

\Excel.Chart.5\shell\VirusScan

\Excel.Chart.8\shell\VirusScan

\Excel.Macrosheet\shell\VirusScan

\Excel.Sheet.5\shell\VirusScan

\Excel.Sheet.8\shell\VirusScan

\Excel.Template\shell\VirusScan

\Excel.Workspace\shell\VirusScan

\Excel.XLL\shell\VirusScan

\exefile\shell\VirusScan

\Office.Binder.8\shell\VirusScan

\Office.Binder.98\shell\VirusScan

\rtffile\shell\VirusScan

\VSConfigFile

\VSHConfigFile

\WinZip\shell\VirusScan

\Word.Document.6\shell\VirusScan

\Word.Document.8\shell\VirusScan

\Word.RTF\shell\VirusScan

\Word.RTF.8\shell\VirusScan

\Word.Template\shell\VirusScan

\Word.Template.8\shell\VirusScan

C. Move to the HKEY_LOCAL_MACHINE\SOFTWARE folder, then delete these keys or entries:

1. McAfee \Scan95 \ScreenScan

2. \Microsoft\Windows\CurrentVersion\AppPaths\

\SCAN32.EXE

\SCRSCAN.EXE

\VSHWIN32.EXE

3. \Microsoft\Windows\CurrentVersion\Controls Folder\Display\shellex\PropertySheetHandlers \ScrScanP

4. \Microsoft\Exchange\Client\Extensions\

\Exchange Scan="4.0;C:\Program Files\Network Associates\McAfee VirusScan\emalscan.dll;1;11000000000000;1110000;"

\Outlook Setup Extension= "4.0;Outxxx.dll;7;000000000000000;0000000000;OutXXX"

5. \Microsoft\Windows\CurrentVersion\Run\

\AvconsoleExe="C:\Program Files\Network Associates\McAfee VirusScan\avconsole.exe /minimize"

\McAfeeWebScanX="C:\Program Files\Network Associates\McAfee VirusScan\WebScanX.exe"

\Vshwin32EXE="C:\Program Files\Network Associates\McAfee VirusScan\VSHWIN32.EXE"

\VsStatEXE="C:\Program Files\Network Associates\ McAfee VirusScan\VSSTAT.EXE"

6. \Microsoft\Windows\CurrentVersion\RunServices \Vshwin32EXE="C:\Program Files\Network Associates\McAfee VirusScan\VSHWIN32.EXE"

7. \Microsoft\Windows\CurrentVersion\Controls Folder\ \Display\shellex\PropertySheetHandlers\ScrScanP\@="{C88249A0-AD7E-11cf-AD53-444553540000}"

8. \Microsoft\Windows\CurrentVersion\SharedDLLs

\C:\WINDOWS\SYSTEM\MCAFECOM.DLL

\C:\WINDOWS\SYSTEM\MCKRNL.VXD

\C:\WINDOWS\SYSTEM\MCSCAN32.VXD

\C:\WINDOWS\SYSTEM\MCUTIL.VXD

\C:\WINDOWS\SYSTEM\VSHIELD.VXD

\C:\WINDOWS\SYSTEM\VSHINIT.VXD

9. \Microsoft\Windows\CurrentVersion\Uninstall

\McAfee VirusScan

D. Move to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\ folder, then delete these keys or entries:

\VSHINIT

4. Restart your computer.

5. Delete VirusScan files and directories. To do so, follow these steps:

A. Click Start, point to Programs, then choose Windows Explorer.

B. Locate the folder that contains your copy of VirusScan. If you chose the default installation options, you should find VirusScan in this directory path: Program Files\Network Associates\McAfee VirusScan

C. Remove the following files from the \Windows\system directory on your hard disk:

MCAFECOM.DLL

MCKRNL.VXD

MCSCAN32.VXD

MCUTIL.VXD

VSHIELD.VXD

VSHINIT.VXD

After following the manual uninstall directions from above, you should search the registry for any instances of 'Network Associates' and 'Scan' (for the positive hits for the Scan search, check the key to see if it looks like it would be related to VirusScan and not other system scan functions).

You have now removed VirusScan from your system. Restart your computer to have your changes take effect.

Back to Security, hacker detection & forensics FAQ Index
Back to Security, hacker detection & forensics Forum

My Archive

Close Box

Join Tek-Tips® Today!

Join your peers on the Internet's largest technical computer professional community.
It's easy to join and it's free.

Here's Why Members Love Tek-Tips Forums:

Register now while it's still free!

Already a member? Close this window and log in.

Join Us             Close