Manually uninstalling Symantec AntiVirus Corporate Edition 9.0 server from Windows NT/2000/XP/2003

Article:TECH100614  |  Created: 2004-01-06  |  Updated: 2006-01-31  |  Article URL http://www.symantec.com/docs/TECH100614
Article Type
Technical Solution


Environment

Issue



This document describes how to uninstall the Symantec AntiVirus Corporate Edition 9.0 server from Windows NT/2000/XP or Windows Server 2003 (32-bit) manually.


Solution



Removing Symantec AntiVirus manually comprises the following four basic steps:
  • Stop Symantec AntiVirus services
  • Remove Symantec AntiVirus from the registry
  • Remove Symantec AntiVirus from the Start menu
  • Remove Symantec AntiVirus from the hard drive

Stop Symantec AntiVirus services
Stop the following services before removing items from the registry, Start menu, or hard drive.
  • Intel Alert Handler
  • Intel Alert Originator
  • Intel File Transfer
  • Intel PDS
  • Symantec AntiVirus
  • Symantec AntiVirus Definition Watcher

Manually removing registry entries

Note: You must have administrator permissions (read and write) to edit the registry.


WARNING: In the next steps you will edit the Windows registry. Back up the registry before you make any changes to it, because incorrect changes to the registry can result in permanent data loss or corrupted files. Modify only the registry keys that are specified.
For instructions, see How to back up the Windows registry.


To edit the registry

  1. In the left pane, go to the following key:

    HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers

  2. Right-click the LDVPMenu entry, and then click Delete.
  3. Go to the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec

  4. Delete the Symantec AntiVirus key.
  5. Go to the following key in the left pane:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

  6. Delete the following entries:
    • DefWatch
    • NAVENG
    • NAVEX15
    • SAVRT
    • SAVRTPEL
    • Symantec AntiVirus
  7. Delete the SymEvent entries only if Symantec AntiVirus 9.0 is the only Symantec program installed.
  8. Go to any existing ControlSet\Services keys, and delete the same entries as in step 6.
  9. Go to the following key:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\Application

  10. Delete the following entries:
    • Defwatch
    • Symantec AntiVirus
  11. Go to the following key:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\System

  12. Delete the SAVRT entry.
  13. Go to the following key:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\lanmanserver\Shares\Security

  14. Delete the following entries:
    • VPHOME
    • VPLOGON
  15. Go to any existing ControlSet\Services\EventLog\Application keys, and delete the same entries as in steps 9 through 14.
  16. Go to the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\INTEL

  17. Under the Intel key, expand the DllUsage key, and then delete the VP6 key.

    WARNING: Be careful not to delete the Intel folder, since other programs or hardware might be using this key.
  18. In the left pane, select My Computer, and then, on the Edit menu, click Find.
    Search for "VirusProtect6" and delete all instances of this string.
  19. Select My Computer, and then, on the Edit menu, click Find.
    Search for "497CA84818B8A04418EA464733D75B72" and delete all instances of this string.


    WARNING: Follow the next two steps only if no other Symantec applications use virus definitions on the computer. If there are applications using virus definitions when the SharedDefs key is deleted, they will have to be uninstalled and reinstalled in order to function.
  20. If no other Symantec applications that use virus definitions are installed, go to the following key; otherwise, go to step 22:

    HKEY_LOCAL_MACHINE\Software\Symantec

  21. Delete the SharedDefs entry.
  22. Go to the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps

  23. Delete the following entries:
    • VP6ClientInstalled
    • VP6UsageCount
  24. Expand the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

    This key contains many keys.

  25. Click each key, and look in the right pane for references to Symantec AntiVirus.
    If you see any references to Symantec AntiVirus in the right pane, then delete the entire key.

  26. Go to the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

  27. Delete the Vptray value.
  28. Restart the computer

Symantec AntiVirus Corporate Edition server is now disabled, even though traces of it remain in the registry. These traces have little impact on how your computer operates. It is not necessary to remove them.

To remove Symantec AntiVirus Server from the Start menu
  1. On the Windows taskbar, right-click the Start button, and then click Open All Users.
  2. Double-click Programs.
  3. Right-click the Symantec Client Security folder, and then click Delete.
    If there is another Symantec program listed in this folder, open the folder, and delete only the "Symantec AntiVirus Server" icon.
To remove Symantec AntiVirus Server from the hard drive
  1. Start Windows Explorer.
  2. Go to the Program Files folder.
  3. Delete the SAV folder.
  4. Delete the Symantec AntiVirus folder.

    WARNING: Follow the next three steps only if Symantec AntiVirus is the only Symantec application installed. If the VirusDefs folder is deleted while there are other Symantec applications using virus definitions, they must be uninstalled and reinstalled in order for them to function.
  5. If Symantec AntiVirus is the only Symantec product on your computer, delete the Symantec folder.
  6. Go to the Program Files\Common Files\Symantec Shared folder.
  7. If Symantec AntiVirus is the only Symantec product on your computer, delete the VirusDefs folder.
  8. Go to the folder appropriate for your operating system:
    • In Windows NT 4.0, go to the following folder:
      C:\Winnt\Profiles\All Users\Application Data\Symantec
    • In Windows 2000/XP/2003, go to the following folder:
      C:\Documents and Settings\All Users\Application Data\Symantec
  9. Delete the Symantec AntiVirus Corporate Edition folder.
  10. Exit Windows Explorer.







Legacy ID



2004040615324548


Article URL http://www.symantec.com/docs/TECH100614


Terms of use for this information are found in Legal Notices