Contact US

Log In

Come Join Us!

Are you a
Computer / IT professional?
Join Tek-Tips Forums!
  • Talk With Other Members
  • Be Notified Of Responses
    To Your Posts
  • Keyword Search
  • One-Click Access To Your
    Favorite Forums
  • Automated Signatures
    On Your Posts
  • Best Of All, It's Free!

*Tek-Tips's functionality depends on members receiving e-mail. By joining you are opting in to receive e-mail.

Posting Guidelines

Promoting, selling, recruiting, coursework and thesis posting is forbidden.

Students Click Here

Security, hacker detection & forensics FAQ


Could not start the AVSync Manager service - Removing the LEGACY keys to allow VirusScan or NetShield to install. by jbrackett
Posted: 11 Aug 04 (Edited 20 Aug 04)

Goal and/or Problem Description : Removing the LEGACY keys to allow VirusScan or NetShield to install in the event of the following circumstances:

Error: "The McShield service returned service specific error 5020"

Error: "Could not start the AVSync Manager service on \\wkstn"

Error 1067: The process terminated unexpectedly

Error: NAIFILTR.SYS not found when installing VirusScan 4.5

Error: "NAIFILTR.SYS not found"

Event ID 7000 in event viewer

ERROR "Could not contact filter driver naifiltr.sys"
Services not starting after install

Previous version of VirusScan/NetShield on the computer.
Product not uninstalled using the Add/Remove Programs applet in the Control Panel.

Problem Environment:
McAfee VirusScan 4.5
McAfee VirusScan 4.5.1
McAfee NetShield 4.5
Microsoft Windows 2000
Microsoft Windows NT

Cause of this problem: Some drivers are still installed from the previously installed AntiVirus software.

NOTE: The below keys are not installed or removed by McAfee software. These registry entries are created by the operating system. The effects of removing them cannot be guaranteed by Network Associates.

If VirusScan or NetShield is still installed, run the uninstall applet from the Control Panel using Add/Remove Programs. When the uninstall is complete, from the Start menu choose Run and execute "REGEDT32".  Browse to HKEY_Local_Machine\System\ControllSet001\ENUM\ROOT and highlight the following LEGACY keys, depending on which product you are using, one at a time. After insuring the correct key is highlighted, follow steps A-H listed below for each LEGACY key listed.

For NetShield:

For VirusScan:

A. Click on Security | Permissions
B. Check the option for "Everyone" to have full control (the option in the bottom pane of the Permissions Tab).
C. Click the "Advanced" button (Windows 2000 only).
D. Check the option to 'Reset Permissions on all child objects and enable propagation of inheritable permissions.'
E. Click 'Apply'
F. Click 'OK' to the message, "This will remove explicitly defined permissions on all child objects and enable propagation of inheritable permissions to those child objects. Only the inheritable permissions propagates from the LEGACY_***** will take effect. Do you Wish to continue?"

G. Press the "Del" key on your keyboard to delete the LEGACY key.
H. Select 'Yes' to the message, "Registry Editor will delete the currently selected key and all its subkeys. Do you want to continue the operation?"

Repeat steps for the same LEGACY keys in ControllSet002\ENUM\ROOT and ControllSet003\ENUM\ROOT if present.

Delete the folder C:\Program files\Network Associates\VirusScan, C:\Program Files\Network Associates\NetShield 2000 or the directory you to which you installed the program, if you installed to a different location.

When this is complete, reboot the system.

You should now be able to run the installation program again.

Back to Security, hacker detection & forensics FAQ Index
Back to Security, hacker detection & forensics Forum

My Archive

Close Box

Join Tek-Tips® Today!

Join your peers on the Internet's largest technical computer professional community.
It's easy to join and it's free.

Here's Why Members Love Tek-Tips Forums:

Register now while it's still free!

Already a member? Close this window and log in.

Join Us             Close