Manual remove of McAfee epolicy agent 4.x - Powered By Kayako SupportSuite

09 Sep 2010

Support Center » Knowledgebase » Manual remove of McAfee epolicy agent 4.x

	Manual remove of McAfee epolicy agent 4.x

Solution https://kc.mcafee.com/corporate/index?page=content&id=KB65863

KnowledgeBase Home
Corporate KnowledgeBase
Manual removal instructions for McAfee Agent 4.x
Printer Friendly Version Printer Friendly Rate Content Rate this Page

Corporate KnowledgeBase ID: KB65863
Published: February 08, 2007

Environment
All supported operating systems. For details, see KB51109
Problem
Sometimes, McAfee Agent might have to be manually removed and can include the following:

*
Upgrades fail leaving mismatched files that breaks MA and stops the /Forceuninstall from removing the MA
*
Issue with VirusScan Enterprise 8.5 and later with the option Prevent McAfee services from being stopped
*
Corruption of files previously installed CMA prior to upgrade
*
Third-party conflicts

Solution 1
First, try to remove McAfee Agent using frminst.exe /forceuninstall
Try this before using the manual removal instructions shown later.

Step 1 - Check if VirusScan Enterprise Access Protection rule needs to be disabled.
With the release of McAfee VirusScan 8.5i and later with its Access Protection rule (Prevent McAfee services from being stopped). Disable either locally or via ePolicy Orchestrator (ePO) the option Prevent McAfee services from being stopped. With this option disabled, you can remove the McAfee Agent (MA) using either the frminst.exe /forceuninstall (this solution) or the manual removal procedure in the next solution.

Option 1 - If VSE 8.xi is not managed by ePO:
Disable the option: Prevent McAfee services from being stopped:

1.
Click, Start, Programs, McAfee, VirusScan Console.
2.
Right-click on Access Protection and select Properties.
3.
Deselect Prevent McAfee services from being stopped.
4.
Click Apply.
5.
Close the VirusScan Console.
6.
Now follow the steps in Step 2.

Option 2 - If VSE 8.xi is ePO managed:
Log on to the ePO console and disable the option Prevent McAfee services from being stopped:

1.
Click Start, Programs, McAfee, ePolicy Orchestrator Console.
2. Select the directory or computer level the VSE8.xi policy will changed.
3.
In the right pane expand the Virus Enterprise policy.
4.
Click Edit next to Access Protection Policies.
5.
Click the Access Protection tab.
6.
Deselect Prevent McAfee services from being stopped.
7.
Click Apply.
8.
Send an Agent Wakeup Call to to apply changes or wait for the next enforce policy to take effect.
9.
Close the ePO Console.

Step 2 - Try to remove McAfee Agent using frminst.exe /forceuninstall:

1.
Click Start, Run and type one of the following commands:

*
"c:\Program Files\Network Associates\Common Framework\frminst.exe" /forceuninstall
*
"c:\Program Files\McAfee\Common Framework\frminst.exe" /forceuninstall

NOTE: The path will vary depending on the version, upgrade or clean install. Use Windows Explorer to determine the correct path.

2.
Restart the system to remove McAfee Agent processes from memory and complete the deletion of files.

If this removal procedure fails, then follow the manual removal instructions in the next solution
Solution 2
Manually removing McAfee Agent 4.x.
IMPORTANT: Before preceding, check if the VirusScan Enterprise Access Protection rule needs to be disabled, as documented in the previous solution.

CAUTION: This article contains information about opening or modifying the registry.

* The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
* Before proceeding, McAfee strongly recommends backing up your registry and understanding the restore process. For more information, see: http://support.microsoft.com/kb/256986
* Do not run a .REG file that is not confirmed to be a genuine registry import file.

Step 1 - If the McAfee Framework Service cannot be disabled then this has to be done via registry as all access to the service is denied due to self-protection:

1.
Click Start, Run..., type regedit.exe, then click OK.
2.
Navigate to the following key: [HKLM\SYSTEM\CurrentControlSet\Services\McAfeeFramework]
3.
Double-click the Start value and set the value data to 4.
4.
Restart the system, the McAfee Framework Service is now disabled.

Step 2 - End Process on all running McAfee Agent Processes:

1. Press CTRL+ALT+DEL to open the Task Manager.
2. Click the Processes tab.
3. Select individually each of the following processes, then click End Process. Click Yes when prompted.

McTray.exe
UpdaterUI.exe
naPrdMgr.exe

4. Close Task Manager.

Step 3 - Registry edits:

1. Click Start, Run, type regedit.exe, then click OK.
2. Navigate to the following key: [HKLM\SYSTEM\CurrentControlSet\Services]
3. Right-click on McAfeeFramework and select Delete.
4. Also check for the existence of a McAfeeFramework sub-key (and delete them) under the following registry keys:

[HKLM\SYSTEM\ControlSet001\Services]
[HKLM\SYSTEM\ControlSet002\Services]
[HKLM\SYSTEM\ControlSetXXX\Services]

5. Navigate to the following registry key: [HKLM\SOFTWARE\Network Associates\TVD\Shared Components\Framework]
6. Make note of the Installed Path and the Data Path values.
7. Delete the two folders mentioned in the above registry values.
8. Navigate to the following key: [HKLM\SOFTWARE\Network Associates\TVD\Shared Components]
9. Right-click Framework and select Delete.
10. Navigate to the following key: [HKLM\SOFTWARE\McAfee\McTray]
11. Right-click McTray, then select Delete.
12. Navigate to the following key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\]
13. Right-click [{36FE3EDA-0C18-48DE-934B-D9862F82A7A8}], then select Delete.
14. Close the registry editor.
15. Restart your computer.

Related Information

KB57061 - Manual removal instructions for Common Management Agent 3.5.x
KB55208 - Manual removal instructions for Common Management Agent 3.6.x
Previous Document ID
9611891

Rate this Page

Please take a moment to complete this form to help us better serve you.
Rate this document 1 2 3 4 5(Best)

Did this article resolve your issue? Yes No

Please provide any comments below Optional

Your response will be used to improve our document content. Requests for assistance should be submitted through your normal support channel as we cannot respond from this site.
Rate Content

Find Answers
Ask a New Question
manual remove of mcafee epolicy agent
Ask
Previous ↓
Previous ↑

Previously Asked Questions
Document asdfasdf
Document anti
Document foundstone update
Document how do you setup ipsec with high availability on an sg720?
Document foundstone
Document can ipsec be setup with high availability on sg720?
Also See
PDF McAfee Policy Auditor 5.2.0 Product Guide for ePolicy Orchestrator 4.5
PDF McAfee Data Loss Prevention 2.2 Patch 2 Installation Guide
PDF McAfee Host Data Loss Prevention 2.2 Patch 2 Product Guide
PDF McAfee ePolicy Orchestrator 4.0.2 Product Guide
PDF McAfee ePolicy Orchestrator 4.5 Product Guide
Corporate KnowledgeBase Information
Categories:

* McAfee Agent 4.0
* EPolicy Orchestrator

Article Details

Article ID:

Created On:

04 Dec 2009 11:43 AM