Manually uninstalling Symantec AntiVirus 9.x client from Windows NT/2000/XP/2003

Article:TECH100621  |  Created: 2004-01-08  |  Updated: 2010-09-03  |  Article URL http://www.symantec.com/docs/TECH100621
Article Type
Technical Solution


Environment

Issue



This document describes how to uninstall Symantec AntiVirus 9.x client from Windows NT/2000/XP or Windows Server 2003 (32-bit) manually.

 


Solution



Removing Symantec AntiVirus client manually takes the following four basic steps:

  1. Stop Symantec AntiVirus services
  2. Remove Symantec AntiVirus from the registry
  3. Remove Symantec AntiVirus from the Start menu
  4. Remove Symantec AntiVirus from the hard drive
     


Stop Symantec AntiVirus services
Stop the following services before removing items from the registry, Start menu, or hard drive.

  • Intel Alert Handler
  • Intel Alert Originator
  • Intel File Transfer
  • Intel PDS
  • SAVRoam
  • Symantec AntiVirus Definition Watcher
  • Symantec Event Manager
  • Symantec Network Drivers Service
  • Symantec Password Validation
  • Symantec SecurePort
  • Symantec Settings Manager
  • Symantec AntiVirus


To stop the services

  1. On the Windows taskbar, click Start > Run.
  2. In the Run Dialog box type the following:

    services.msc
  3. Click OK.
  4. Right-click the Intel Alert Handler service, and click Stop.
  5. Perform step 4 for each of the services listed above.



 


WARNING: In the next steps you will edit the Windows registry. Back up the registry before you make any changes to it, because incorrect changes to the registry can result in permanent data loss or corrupted files. Modify only the registry keys that are specified.
For instructions, see How to back up the Windows registry.




To remove the Symantec AntiVirus keys from the registry

  1. In the Registry Editor, go to the following key:

    HKEY_CLASSES_ROOT\*\Shellex\ContextMenuHandlers

     
  2. Right-click the LDVPMenu entry, and then click Delete.
  3. Go to the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec

     
  4. Delete the following keys:
    • Common Client
    • SharedDefs
    • Symantec AntiVirus
    • Symevent
    • SymNetDrv
       
  5. Go to the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps

     
  6. In the right pane, delete the following values:
    • VP6ClientInstalled
    • VP6UsageCount
    • AVENGEDEFS
    • Common Client
    • Common Client Data
    • Common Client Decomposers
    • IDSDefs
    • SAVCE
    • SAV Install Directory
    • SCS Install Directory
    • Symantec Shared Directory
    • SymNetDrv
       
  7. Go to the following key:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

     
  8. Delete the following keys:
    Delete the SymEvent keys only if Symantec Client Security is the only Symantec program installed.
    • ccEvtMgr
    • ccPwdSvc
    • ccSetMgr
    • DefWatch
    • Intel Alert Handler
    • Intel Alert Originator
    • Intel File Transfer
    • Intel PDS
    • NAVENG
    • NAVEX15
    • SavRoam
    • SAVRT
    • SAVRTPEL
    • SNDSrvc
    • Symantec AntiVirus
    • SymEvent
    • SYMREDRV
    • SYMTDI
       
  9. Go to any existing "ControlSet*"\Services keys and delete the same entries like in the previous step.
  10. Delete the SymEvent keys only if Symantec Client Security is the only Symantec program installed.
  11. Go to the following key:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\Application

  12. Delete the following entries:
    • Defwatch
    • ccEvtMgr
    • ccSetMgr
    • Intel Alert Handler
    • Intel Alert Originator
    • Intel AMS II
    • Intel File Transfer Service
    • Intel PDS Service
    • SavRoam
    • Symantec AntiVirus
       
  13. Go to the following key in the left pane:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System

     
  14. Delete the SAVRT key.
  15. Go to any existing "ControlSet*"\Services\EventLog\Application and "ControlSet*"\Services\EventLog\System keys and delete the same entries as in the previous four steps.
  16. Go to the following key in the left pane:

    HKEY_LOCAL_MACHINE\SOFTWARE\INTEL

     
  17. Under the Intel key, expand the DllUsage key, and then delete the VP6 key.


    WARNING: Make sure not to delete the Intel folder, since other programs or hardware might be using this key.

  18. In the left pane, click My Computer.
  19. Click Edit > Find.
  20. In the left pane, highlight "My Computer."
  21. Search for VirusProtect6 and delete all entries of this key.
    Repeat this step until no more instances of "VirusProtect6" are found.
     
  22. In the left pane, click My Computer.
  23. Click Edit > Find.
  24. Search for the following string:

    497CA84818B8A04418EA464733D75B72

     
  25. Delete all entries found.


    WARNING: Follow the next two steps only if no other Symantec applications use virus definitions on the computer. If there are applications using virus definitions when the SharedDefs key is deleted, they will have to be uninstalled and reinstalled in order to function.

  26. If other Symantec applications that use virus definitions are installed, skip to step 31. Otherwise, go to the HKEY_LOCAL_MACHINE\Software\Symantec key.
  27. Delete the SharedDefs entry.
  28. Expand the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

    This key contains many keys.

     
  29. Click each key, and look in the right pane for references to Symantec AntiVirus.
    If you see any references to Symantec AntiVirus in the right pane, then delete the entire key.
     
  30. Go to the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

     
  31. Delete the vptray and ccApp values.
  32. Restart the computer.


Symantec AntiVirus is now disabled, even though traces of it remain in the registry. These traces have little impact on how your computer operates. It is not necessary to remove them.

To remove Symantec Client Security from the Start menu

  1. Right-click the Start button, and then click Open All Users.
  2. Double-click Programs.
  3. Right-click the Symantec Client Security folder, and then click Delete.



To remove Symantec Client Security from the hard drive

  1. Click Start, point to Programs, and then click Windows Explorer.
  2. Go to the Program Files folder.
  3. Delete the Symantec AntiVirus folder.


    WARNING: Follow the next three steps only if Symantec AntiVirus is the only Symantec application installed. If the VirusDefs folder is deleted while there are other Symantec applications using virus definitions, they must be uninstalled and reinstalled in order for them to function.
  4. If Symantec AntiVirus is the only Symantec product on your computer, delete the Symantec folder.
  5. Go to the Program Files\Common Files\Symantec Shared folder.
  6. If Symantec AntiVirus is the only Symantec product on your computer, delete the VirusDefs folder.
  7. Go to the folder appropriate for your operating system:
    • In Windows NT 4.0, go to the following folder:
      C:\Winnt\Profiles\All Users\Application Data\Symantec
       
    • In Windows 2000/XP/2003, go to the following folder:
      C:\Documents and Settings\All Users\Application Data\Symantec
       
  8. Delete the Symantec AntiVirus Corporate Edition folder.
  9. Exit Windows Explorer.





 



Legacy ID



2004040815592148


Article URL http://www.symantec.com/docs/TECH100621


Terms of use for this information are found in Legal Notices