NAI POSITION
============
SolutionID: 1.0.1571195.2401624 Printer-Friendly Page
Problem Description:
VirusScan or NetShield not completely uninstalled
Silent uninstall using WCDRSIL.INI
McShield not removed
NaiFsRec not removed
NaiFilter not removed
Problem Environment:
McAfee NetShield
McAfee VirusScan
Microsoft Windows NT
Changes affecting this problem:
VirusScan and NetShield 4.02 were changed to uninstall via the UNINSTALL.INS file.
During that process the WCMDRSIL.INI file did not get the proper changes to run
the silent uninstall using the UNINSTALL.INS file.
Solution:
In order to continue normal use on this system, a manual uninstall must be performed.
These instructions are included in the WHATSNEW.TXT file that was included
with the program or you can view the solution Manual Uninstall of VirusScan & NetShield.
MANUALLY UNINSTALL V4.03a
=========================
UNINSTALLING VIRUSSCAN SOFTWARE
To uninstall VirusScan software, click Start in the Windows
taskbar, point to Settings, then choose Control Panel.
Next, double-click the Add/Remove Programs control panel in
the folder, then select VirusScan from the program list.
Click Add/Remove to remove the program from your computer.
To remove VirusScan software without using the utility,
follow these steps:
1. Remove references to VirusScan software from your
AUTOEXEC.BAT and your SYSTEM.INI files. To do so,
follow these steps:
A. Start the Windows system editor. Click Start in
the Windows taskbar, then choose Run. Type
SYSEDIT in the Run dialog box, then click OK.
A set of text files will open on your screen. Your
AUTOEXEC.BAT file should appear as the first or
topmost window in this set. Click the title bar for
the SYSTEM.INI window to bring it to the foreground,
then locate this line:
[boot]SCRNSAVE.EXE=C:\PROGRA~1\NETWOR~1\MCAFEE~1\SCRSCAN.EXE
B. Change the line to read:
[boot]SCRNSAVE.EXE=C:\WINDOWS\SYSTEM\WINDOW~1.SCR
D. When you have deleted all VirusScan references in
your AUTOEXEC.BAT file and restored your SYSTEM.INI
file to its original state, choose Save from the
SYSEDIT File menu to save your changes, then choose
Exit from the File menu to quit the SYSEDIT
application.
2. Remove VirusScan icons from the Start menu. To do this,
follow these steps:
A. Click Start in the Windows taskbar, point to
Settings, then choose Taskbar.
B. Click the Start Menu Programs tab.
C. Click the Remove button.
D. Select the McAfee VirusScan folder in the list that
appears in the Remove Shortcuts/Folders dialog box,
then click Remove.
E. Windows will ask you to confirm your action. Click
Yes to continue.
F. Click Close to close the Remove Shortcuts/Folders
dialog box, then click OK to close the Taskbar
Properties dialog box.
3. Edit the Registry. To do this, follow these steps:
A. Start the Windows Registry editor. Click Start in
the Windows taskbar, then choose Run. Type REGEDIT
in the Run dialog box, then click OK.
B. Click + to expand the HKEY_LOCAL_MACHINE folder,
click + again to expand the SOFTWARE folder, then
click one more time to expand the CLASSES folder.
Next, delete these keys or entries:
.vsc
.vsh
\CLSID\{9EF56D61-A50F-11ce-B105-0000C04B2D52}
\CLSID\{C88249A0-AD7E-11cf-AD53-444553540000}
\comfile\shell\VirusScan
\Directory\shell\VirusScan
\Drive\shell\VirusScan
\Excel.Addin\shell\VirusScan
\Excel.Chart.5\shell\VirusScan
\Excel.Chart.8\shell\VirusScan
\Excel.Macrosheet\shell\VirusScan
\Excel.Sheet.5\shell\VirusScan
\Excel.Sheet.8\shell\VirusScan
\Excel.Template\shell\VirusScan
\Excel.Workspace\shell\VirusScan
\Excel.XLL\shell\VirusScan
\exefile\shell\VirusScan
\Office.Binder.8\shell\VirusScan
\Office.Binder.98\shell\VirusScan
\rtffile\shell\VirusScan
\VSConfigFile
\VSHConfigFile
\WinZip\shell\VirusScan
\Word.Document.6\shell\VirusScan
\Word.Document.8\shell\VirusScan
\Word.RTF\shell\VirusScan
\Word.RTF.8\shell\VirusScan
\Word.Template\shell\VirusScan
\Word.Template.8\shell\VirusScan
C. Move to the HKEY_LOCAL_MACHINE\SOFTWARE folder, then
delete these keys or entries:
1. McAfee
\Scan95
\ScreenScan
2. \Microsoft\Windows\CurrentVersion\AppPaths\
\SCAN32.EXE
\SCRSCAN.EXE
\VSHWIN32.EXE
3. \Microsoft\Windows\CurrentVersion\
Controls Folder\Display\shellex
\PropertySheetHandlers
\ScrScanP
4. \Microsoft\Exchange\Client\Extensions\
\Exchange Scan="4.0;C:\Program Files
\Network Associates\McAfee VirusScan
\emalscan.dll;1;11000000000000;1110000;"
\Outlook Setup Extension=
"4.0;Outxxx.dll;7;000000000000000;0000000000;OutXXX"
5. \Microsoft\Windows\CurrentVersion\Run\
\AvconsoleExe
\McAfeeWebScanX
\Vshwin32EXE
\VsStatEXE
6. \Microsoft\Windows\CurrentVersion\RunServices
\Vshwin32EXE
7. \Microsoft\Windows\CurrentVersion\SharedDLLs
\C:\WINDOWS\SYSTEM\MCAFECOM.DLL
\C:\WINDOWS\SYSTEM\MCKRNL.VXD
\C:\WINDOWS\SYSTEM\MCSCAN32.VXD
\C:\WINDOWS\SYSTEM\MCUTIL.VXD
\C:\WINDOWS\SYSTEM\VSHIELD.VXD
\C:\WINDOWS\SYSTEM\VSHINIT.VXD
8. \Microsoft\Windows\CurrentVersion\Uninstall
\McAfee VirusScan
D. Move to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\VxD\ folder, then delete these keys or entries:
\VSHINIT
4. Restart your computer.
5. Delete VirusScan files and directories. To do so, follow
these steps:
A. Click Start, point to Programs, then choose Windows
Explorer.
B. Locate the folder that contains your copy of the
VirusScan software. If you chose the default
installation options, you should find the program
files in this directory path:
Program Files\Network Associates\McAfee VirusScan
C. Remove the following files from the \Windows\system
directory on your hard disk:
MCAFECOM.DLL
MCKRNL.VXD
MCSCAN32.VXD
MCUTIL.VXD
VSHIELD.VXD
VSHINIT.VXD
You have now removed the VirusScan software from your system.
Restart your computer to have your changes take effect.
NAI DESC TO MANUALLY UNINSTALL 4.02/4.03
========================================
SolutionID: 2.0.2466184.1875854 Printer-Friendly Page
Problem Description:
Performing a manual uninstall VirusScan & NetShield NT 4.02 & 4.03
Problem Environment:
McAfee VirusScan 4.03
McAfee VirusScan 4.03a
McAfee NetShield 4.02
McAfee NetShield 4.03
McAfee NetShield 4.03a
Microsoft Windows NT
McAfee VirusScan 4.02
Solution:
These instructions are also located in the whatsnew.txt
* UNINSTALLING VIRUSSCAN WITHOUT THE UNINSTALLATION UTILITY *
1. Before starting, follow these two substeps:
a. Run the Windows NT utility RDISK to create an
emergency repair disk.
b. Run the command UNLODCTR MCSHIELD from the Windows NT
command line to stop the registry from recording
performance counter information for the McShield
service.
2. Open the Windows NT Services Control Panel, then stop
the Network Associates Task Manager service, the
Network Associates McShield service, and the Network
Associates AlertManager service.
3. Stop the VirusScan console if running.
4. Using the NT Task Manager, end the SHSTAT process.
5. If you use SNMP, stop the SNMP service in
Control Panel/Services.
6. Delete the VirusScan installation directory (the
directory that contains the VirusScan executables).
7. Delete this device driver file from %SYSTEMROOT%
\SYSTEM32\DRIVERS
NAIFSREC.SYS
MCFSREC.SYS
MCSCAN.SYS
MCUTIL.SYS
MCKRNL.SYS
MCFILTER.SYS
MCSHIELD.SYS
Delete this file from %SYSTEMROOT%\SYSTEM32\
DSSDATA.DLL
8. If you are using Windows NT 4.0 and if VirusScan was
set to load at startup, remove the following registry
keys:
HKLM\software\microsoft\windows\CurrentVersion\Run
\Shstatexe
HKLM\software\microsoft\windows\CurrentVersion
\uninstall\VirusScan NT
9. Remove VirusScan installation registry keys:
HKLM\software\mcafee\mcalsnmp
HKLM\software\network associates\VirusScan for Windows NT
HKLM\software\mcafee\virusscan
HKLM\software\mcafee\alertmanager (Do not remove this
key if you have
other Network
Associates products
installed that use
Alertmanager.)
10. Remove VirusScan device driver and service registry
keys:
HKLM\system\CurrentControlSet\Services\Alertmanager
HKLM\system\CurrentControlSet\Services\NaiFilter
HKLM\system\CurrentControlSet\Services\NaiFsrec
HKLM\system\CurrentControlSet\Services\McShield
HKLM\system\CurrentControlSet\Services\McTaskManager
HKLM\system\CurrentControlSet\Services\McFilter
HKLM\system\CurrentControlSet\Services\McFsrec
HKLM\system\CurrentControlSet\Services\McKrnl
HKLM\system\CurrentControlSet\Services\McScan
HKLM\system\CurrentControlSet\Services\McUtil
11. If you are using Windows NT 4.0 and the
context-sensitive scanning option was installed, remove
the following registry keys:
HKLM\software\classes\comfile\shell\virusscan
HKLM\software\classes\directory\shell\virusscan
HKLM\software\classes\drive\shell\virusscan
HKLM\software\classes\exefile\shell\virusscan
HKLM\software\classes\word.document.6\shell\virusscan
HKLM\software\classes\word.document.8\shell\virusscan
HKLM\software\classes\word.template\shell\virusscan
12. If you are using Windows NT 4.0 and you want to remove
the Scan for Viruses right-click option, remove the
following registry keys:
HKCR\comfile\shell\VirusScan
HKCR\Directory\shell\VirusScan
HKCR\Drive\shell\VirusScan
HKCR\exefile\shell\VirusScan
HKCR\Excel.Addin\shell\VirusScan
HKCR\Excel.Chart.5\shell\VirusScan
HKCR\Excel.Macrosheet\shell\VirusScan
HKCR\Excel.Sheet.5\shell\VirusScan
HKCR\Excel.Template\shell\VirusScan
HKCR\Excel.Workspace\shell\VirusScan
HKCR\Excel.XLL\shell\VirusScan
HKCR\exefile\shell\VirusScan
HKCR\WinZip\shell\VirusScan
HKCR\Word.Document.6\shell\VirusScan
HKCR\Word.Template\shell\VirusScan
13. To remove SNMP extension agent, remove the following
registry value:
HKLM\system\CurrentControlSet\services\SNMP\parameters\
ExtensionAgent\McAlSNMP
14. Since entries in HkeyClassesRoot are not derived
from a hive, it is unnecessary to delete these keys
manually. When you reboot, VirusScan-specific keys
under HkeyClassesRoot will be removed.
15. Reboot the system.