Manually uninstalling the Symantec AntiVirus Central Quarantine Server from Windows NT/2000/XP/2003

Article:TECH100619  |  Created: 2004-01-08  |  Updated: 2005-01-30  |  Article URL http://www.symantec.com/docs/TECH100619
Article Type
Technical Solution


Environment

Issue



Using Add or Remove Programs has failed, and you need to know how to manually uninstall Symantec Quarantine Server from a computer running Windows NT/2000/XP/2003.


Solution



This document describes how to manually remove Symantec AntiVirus Central Quarantine Server from the following two places:
  • The registry
  • The hard drive

To stop the Quarantine Server services
You must top the following services before removing items from the registry, Start menu, or hard drive:
  • Intel Alert Originator
  • Intel File Transfer
  • Intel PDS
  • Symantec Central Quarantine
  • Symantec Quarantine Agent
  • Symantec Quarantine Scanner
  1. On the Windows taskbar, click Start > Run.
  2. In the Run Dialog box, type the following:

    services.msc
  3. Click OK.
  4. Right-click the Intel Alert Originator service, and click Stop.
  5. Perform step 4 for each of the services listed above.

To remove the Quarantine Server keys from the registry
You must have administrator permissions (read and write) to edit the registry.

WARNING: We strongly recommend that you back up the registry before you make any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify only the keys that are specified. Read the document How to back up the Windows registry for instructions.
  1. Exit all open programs.
  2. On the Windows taskbar, click Start > Run.
  3. In the Run dialog box, type the following:

    regedit
  4. Click OK.
  5. In Registry Editor, navigate to the following key:

    HKEY_CLASSES_ROOT\AppID
  6. Delete the following entries:
    • {C60B0154-894B-11D2-8E5F-2A0712000000}
    • qserver.EXE
  7. Navigate to the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Quarantine
  8. Delete the Server folder.
  9. Navigate to the following key:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
  10. Delete the following entries:
    • IcePack
    • qserver
    • ScanExplicit
  11. Navigate to any existing "ControlSet*\Services" keys, and delete the same entries as in the previous step.
  12. Navigate to the following key:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\Application
  13. Delete the following entries:
    • Central Quarantine
    • Symantec Quarantine Agent
  14. Navigate to any existing "ControlSet*\Services\EventLog\Application" keys, and delete the same entries as in the previous step.
  15. In the left pane, select My Computer.
  16. On the Edit menu, click Find.
  17. Search for the following:

    33B3EEB24F304454BB0D7F2D48D06FF6
  18. Delete all entries that are found.
  19. If other Symantec applications that use virus definitions are installed on your computer, skip to step 21. If no other Symantec application that use virus definitions are installed, navigate to the following key:

    HKEY_LOCAL_MACHINE\Software\Symantec
  20. Delete SharedDefs entry.
  21. Navigate to the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps
  22. Delete the QServer entry.
  23. Navigate to the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  24. Delete the following entries:
    • {2BEE3B33-03F4-4544-BBD0-F7D2840DF66F}
    • Symantec AntiVirus Central Quarantine
  25. Restart the computer

Symantec AntiVirus Central Quarantine is now disabled, even though traces of it remain in the registry. These traces have little impact on how your computer operates. It is not necessary to remove them.


To remove Symantec AntiVirus Central Quarantine from the hard drive
  1. On the Windows taskbar, click Start > Programs > Accessories > Windows Explorer.
  2. Do one of the following:
    • In Windows NT 4.0, navigate to the following folder:
      C:\Winnt\Profiles\All Users\Application Data\Symantec
    • In Windows XP, 2000, and 2003, navigate to the following folder:
      Program Files\Symantec\Quarantine
  3. Delete the Server folder

Symantec AntiVirus Central Quarantine Server is now removed from your computer.





Legacy ID



2004040810364148


Article URL http://www.symantec.com/docs/TECH100619


Terms of use for this information are found in Legal Notices