Environment
For details of all supported operating systems, see KB51109.
Problem
Under certain conditions, you may need to remove the McAfee Agent manually. Possible reasons include:
•A failed upgrade leaves mismatched files that stops the /Forceuninstall from removing the agent
•Issues with the Prevent McAfee services from being stopped option in VirusScan Enterprise 8.5i and later
•Corruption of files in previously installed versions of McAfee Agent or Common Management Agent
•Third-party software conflicts
Solution 1
Before a full manual removal, attempt to remove McAfee agent using frminst.exe and the /forceuninstall switch.
Step 1 - Disable protection of McAfee services in VirusScan Enterprise (if necessary)
VirusScan Enterprise (VSE) 8.5i and later include an Access Protection feature which prevents McAfee services from being stopped. To successfully remove the McAfee Agent, this setting must be disabled either locally or via ePolicy Orchestrator (ePO).
Option 1 - If VSE is not managed by ePO:
1.Click, Start, Programs, McAfee, VirusScan Console.
2.Right-click Access Protection and select Properties.
3.Deselect Prevent McAfee services from being stopped.
4.Click Apply.
5.Close the VirusScan Console.
6.Continue to Step 2.
Option 2 - If VSE managed by ePO:
1.Click Start, Programs, McAfee, ePolicy Orchestrator Console.
2.Select the directory or computer level where the VSE policy will be changed.
3.In the right pane, expand the VirusScan Enterprise policy.
4.Click Edit beside Access Protection Policies.
5.Click the Access Protection tab.
6.Deselect Prevent McAfee services from being stopped.
7.Click Apply.
8.Send an Agent Wakeup Call to apply the changes or wait for the next policy enforcement to take effect.
9.Close the ePO Console.
Step 2 - Run the frminst.exe /forceuninstall command
1.Click Start, Run, and type one of the following commands:
•"c:\Program Files\Network Associates\Common Framework\frminst.exe" /forceuninstall
•"c:\Program Files\McAfee\Common Framework\frminst.exe" /forceuninstall
NOTE: The path will vary depending on the version and whether you installed McAfee Agent as an upgrade or clean install. Use Windows Explorer to determine the correct path.
2.Restart the system to remove McAfee Agent processes from memory and complete the deletion of files.
If this removal procedure fails, follow the manual removal instructions in the next solution.
Solution 2
Manually removing McAfee Agent 4.x.
IMPORTANT: Before proceeding, ensure that you allow McAfee services to be stopped as described in Step 1 above.
CAUTION: This article contains information about opening or modifying the registry.
•The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
•Before proceeding, McAfee strongly recommends backing up your registry and understanding the restore process. For more information, see: http://support.microsoft.com/kb/256986.
•Do not run a .REG file that is not confirmed to be a genuine registry import file.
Step 1 - Disable the McAfee Framework Service in the registry and restart the system
1.Click Start, Run, type regedit.exe, then click OK.
2.Navigate to and select the following key:
[HKLM\SYSTEM\CurrentControlSet\Services\McAfeeFramework]
3.Double-click the Start value and set the Value data to 4.
4.Restart the system.
Step 2 - End all running McAfee Agent processes:
1.Press CTRL+ALT+DEL to open the Task Manager.
2.Click the Processes tab.
3.Individually select each of the processes below and click End Process. Click Yes when prompted.
McTray.exe
UpdaterUI.exe
naPrdMgr.exe
4.Close Task Manager.
Step 3 - Delete McAfee Agent services from the registry
1.Click Start, Run, type regedit.exe, and click OK.
2.Navigate to and expand the following key:
[HKLM\SYSTEM\CurrentControlSet\Services]
3.Right-click the McAfeeFramework sub-key and select Delete.
4.Navigate to each of the keys below and delete the McAfeeFramework sub-key if it exists:
[HKLM\SYSTEM\ControlSet001\Services]
[HKLM\SYSTEM\ControlSet002\Services]
[HKLM\SYSTEM\ControlSetXXX\Services]
5.Navigate to and select the following registry key:
[HKLM\SOFTWARE\Network Associates\TVD\Shared Components\Framework]
6.Make note of the values for Installed Path and Data Path.
7.Delete the two folders mentioned in the above registry values.
8.Navigate to and expand the following key:
[HKLM\SOFTWARE\Network Associates\TVD\Shared Components]
9.Right-click the Framework sub-key and select Delete.
10.Navigate to the following key:
[HKLM\SOFTWARE\McAfee\McTray]
11.Right-click McTray, then select Delete.
12.Navigate to and expand the following key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\]
13.Right-click the appropriate sub-key below and select Delete:
McAfee Agent 4.0 - {F2969393-2D4D-4977-8166-B1251B08EF12}
McAfee Agent 4.5 - {B639A4DE-A375-47D3-89C3-DDCF98D992F7}
14.Close the registry editor.
15.Restart your computer.
For details of all supported operating systems, see KB51109.
Problem
Under certain conditions, you may need to remove the McAfee Agent manually. Possible reasons include:
•A failed upgrade leaves mismatched files that stops the /Forceuninstall from removing the agent
•Issues with the Prevent McAfee services from being stopped option in VirusScan Enterprise 8.5i and later
•Corruption of files in previously installed versions of McAfee Agent or Common Management Agent
•Third-party software conflicts
Solution 1
Before a full manual removal, attempt to remove McAfee agent using frminst.exe and the /forceuninstall switch.
Step 1 - Disable protection of McAfee services in VirusScan Enterprise (if necessary)
VirusScan Enterprise (VSE) 8.5i and later include an Access Protection feature which prevents McAfee services from being stopped. To successfully remove the McAfee Agent, this setting must be disabled either locally or via ePolicy Orchestrator (ePO).
Option 1 - If VSE is not managed by ePO:
1.Click, Start, Programs, McAfee, VirusScan Console.
2.Right-click Access Protection and select Properties.
3.Deselect Prevent McAfee services from being stopped.
4.Click Apply.
5.Close the VirusScan Console.
6.Continue to Step 2.
Option 2 - If VSE managed by ePO:
1.Click Start, Programs, McAfee, ePolicy Orchestrator Console.
2.Select the directory or computer level where the VSE policy will be changed.
3.In the right pane, expand the VirusScan Enterprise policy.
4.Click Edit beside Access Protection Policies.
5.Click the Access Protection tab.
6.Deselect Prevent McAfee services from being stopped.
7.Click Apply.
8.Send an Agent Wakeup Call to apply the changes or wait for the next policy enforcement to take effect.
9.Close the ePO Console.
Step 2 - Run the frminst.exe /forceuninstall command
1.Click Start, Run, and type one of the following commands:
•"c:\Program Files\Network Associates\Common Framework\frminst.exe" /forceuninstall
•"c:\Program Files\McAfee\Common Framework\frminst.exe" /forceuninstall
NOTE: The path will vary depending on the version and whether you installed McAfee Agent as an upgrade or clean install. Use Windows Explorer to determine the correct path.
2.Restart the system to remove McAfee Agent processes from memory and complete the deletion of files.
If this removal procedure fails, follow the manual removal instructions in the next solution.
Solution 2
Manually removing McAfee Agent 4.x.
IMPORTANT: Before proceeding, ensure that you allow McAfee services to be stopped as described in Step 1 above.
CAUTION: This article contains information about opening or modifying the registry.
•The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
•Before proceeding, McAfee strongly recommends backing up your registry and understanding the restore process. For more information, see: http://support.microsoft.com/kb/256986.
•Do not run a .REG file that is not confirmed to be a genuine registry import file.
Step 1 - Disable the McAfee Framework Service in the registry and restart the system
1.Click Start, Run, type regedit.exe, then click OK.
2.Navigate to and select the following key:
[HKLM\SYSTEM\CurrentControlSet\Services\McAfeeFramework]
3.Double-click the Start value and set the Value data to 4.
4.Restart the system.
Step 2 - End all running McAfee Agent processes:
1.Press CTRL+ALT+DEL to open the Task Manager.
2.Click the Processes tab.
3.Individually select each of the processes below and click End Process. Click Yes when prompted.
McTray.exe
UpdaterUI.exe
naPrdMgr.exe
4.Close Task Manager.
Step 3 - Delete McAfee Agent services from the registry
1.Click Start, Run, type regedit.exe, and click OK.
2.Navigate to and expand the following key:
[HKLM\SYSTEM\CurrentControlSet\Services]
3.Right-click the McAfeeFramework sub-key and select Delete.
4.Navigate to each of the keys below and delete the McAfeeFramework sub-key if it exists:
[HKLM\SYSTEM\ControlSet001\Services]
[HKLM\SYSTEM\ControlSet002\Services]
[HKLM\SYSTEM\ControlSetXXX\Services]
5.Navigate to and select the following registry key:
[HKLM\SOFTWARE\Network Associates\TVD\Shared Components\Framework]
6.Make note of the values for Installed Path and Data Path.
7.Delete the two folders mentioned in the above registry values.
8.Navigate to and expand the following key:
[HKLM\SOFTWARE\Network Associates\TVD\Shared Components]
9.Right-click the Framework sub-key and select Delete.
10.Navigate to the following key:
[HKLM\SOFTWARE\McAfee\McTray]
11.Right-click McTray, then select Delete.
12.Navigate to and expand the following key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\]
13.Right-click the appropriate sub-key below and select Delete:
McAfee Agent 4.0 - {F2969393-2D4D-4977-8166-B1251B08EF12}
McAfee Agent 4.5 - {B639A4DE-A375-47D3-89C3-DDCF98D992F7}
14.Close the registry editor.
15.Restart your computer.
No comments:
Post a Comment