Manually uninstalling Symantec AntiVirus 10.1 or Symantec Client Security 3.1 server

Article:TECH101703  |  Created: 2006-01-16  |  Updated: 2007-01-02  |  Article URL http://www.symantec.com/docs/TECH101703
Article Type
Technical Solution


Environment

Issue



This document describes how to manually uninstall Symantec AntiVirus 10.1 or Symantec Client Security 3.1 server from Windows 2003/XP/2000.


Solution





Before you begin: If you have not backed up the pki structure of the server, you should back it up before you remove Symantec AntiVirus. To back up the pki structure, read Steps to minimize recovery time in the event of a server failure.



This procedure involves the following five steps:
  • Disable Tamper Protection before you stop services.
  • Close or stop Symantec AntiVirus programs.
  • Stop Symantec AntiVirus services.
  • Remove Symantec AntiVirus from the registry.
  • Remove Symantec AntiVirus from the Start menu and from the hard drive.

Make sure that Symantec AntiVirus is not running.


Disable Tamper Protection
You must disable Tamper Protection before you stop Symantec AntiVirus services.

To disable Tamper Protection
  1. Start Symantec AntiVirus.
  2. On the Configure menu, click Tamper Protection.
  3. Uncheck Enable Tamper Protection.
  4. Click OK.


End Symantec AntiVirus processes
You must end the following processes before you can continue:
  • Vpc32.exe
  • Vptray.exe

To end the processes
  1. On the Windows taskbar, click Start > Run.
  2. In the Open box, type the following text:

    taskmgr.exe

  3. On the Processes tab, right-click Vpc32.exe, and then click End Process.
  4. Right-click Vptray.exe, and then click End Process.


Stop Symantec AntiVirus services
You must stop the following services before you remove items from the registry, the Start menu, or the hard drive:
  • Intel PDS
  • Symantec AntiVirus
  • Symantec AntiVirus Definition Watcher
  • Symantec Event Manager
  • Symantec Settings Manager


To stop the services
  1. On the Windows taskbar, click Start > Run.
  2. In the Open box, type the following text:

    services.msc

  3. Click OK.
  4. For each of the following services, right-click the name of the service, and then click Stop:
    • Intel PDS
    • Symantec AntiVirus
    • Symantec AntiVirus Definition Watcher
    • Symantec Event Manager
    • Symantec Settings Manager


Remove Symantec AntiVirus from the registry
Most of the items that you must remove are entries in the Windows registry.


Note: You must have administrator permissions (read and write) to edit the registry.



WARNING: In the next steps you will edit the Windows registry. Back up the registry before you make any changes to it, because incorrect changes to the registry can result in permanent data loss or corrupted files. Modify only the registry keys that are specified.
For instructions, see How to back up the Windows registry.


To remove Symantec AntiVirus from the registry
  1. On the Windows taskbar, click Start > Run.
  2. In the Open box, type the following text:

    regedit

  3. Click OK.
  4. In the Windows Registry Editor, in the left pane, go to the following key:

    HKEY_CLASSES_ROOT\*\Shellex\ContextMenuHandlers

  5. In the left pane, right-click LDVPMenu, and then click Delete.
  6. Expand the following key:

    HKEY_CLASSES_ROOT\Installer\Features

    This key contains many keys.

  7. Click each key, and look in the right pane for references to SAVMain.
    If you see any references to SAVMain in the right pane, then delete the entire key.

  8. Expand the following key:

    HKEY_CLASSES_ROOT\Installer\Products

    This key contains many keys.

  9. Click each key, and look in the right pane for references to Symantec AntiVirus or to Symantec Client Security.
    If you see any references to Symantec AntiVirus or to Symantec Client Security in the right pane, then delete the entire key.

  10. Expand the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products

    This key contains many keys.

  11. Expand each key, and then click the InstallProperties key.
    If you see any references to Symantec AntiVirus or to Symantec Client Security in the right pane, then delete the entire key.

  12. Expand the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

    This key contains many keys.

  13. Click each key, and look in the right pane for references to Symantec AntiVirus or to Symantec Client Security.
    If you see any references to Symantec AntiVirus or to Symantec Client Security in the right pane, then delete the entire key.

  14. Delete the following keys:
    • HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\DllUsage\VP6
    • HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SPBBC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec AntiVirus
    • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\System\SAVRT
    • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanserver\Shares\Security\VPHOME
    • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanserver\Shares\Security\VPLOGON

  15. Click the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps

  16. In the right pane, delete the following values:
    • AMSUsageCount
    • AVENGEDEFS
    • Common Client
    • Common Client Data
    • Common Client Decomposers
    • NAVNT
    • SAV Install Directory
    • SAVCE
    • SPBBC
    • Symantec Shared Directory
    • VP6ClientInstalled
    • VP6UsageCount

  17. Expand the following key:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

  18. Delete the following subkeys:
    • ccEvtMgr
    • ccSetMgr
    • DefWatch
    • NAVENG
    • NAVEX15
    • SAVRT
    • SAVRTPEL
    • SPBBCDrv
    • SPBBCSvc
    • Symantec AntiVirus

  19. Expand the following key:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\Application

  20. Delete the following subkeys:
    • DefWatch
    • Symantec AntiVirus
    • SPBBCSvc
    • ccEvtMgr
    • ccSetMgr

  21. In the left pane, click My Computer.
  22. On the Edit menu, click Find.
  23. In the Find what box, type the following text:

    VirusProtect6

    Delete all keys and values that contain this string.

  24. In the left pane, click My Computer.
  25. On the Edit menu, click Find.
  26. In the Find what box, type the following text:

    vpshell2.dll

    Delete all keys and values that contain this string.


    WARNING: Follow the next five steps only if the conditions that are described in the steps are met. These instructions affect registry entries that other Symantec products use. If you delete a key or value that another Symantec product uses, that product must be removed and installed again.


  27. If Symantec AntiVirus is the only Symantec program that is installed, go to the following key:

    HKEY_CLASSES_ROOT\CLSID

    Delete all of the {E381F1E0-910E-11D1-AB1E-00A0C90F8F6F} subkeys.

  28. If no other Symantec application that uses virus definitions is installed, then delete the following key:

    HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs

  29. If Symantec AntiVirus is the only Symantec program that is installed, delete the following keys:
    • HKEY_LOCAL_MACHINE\Software\Symantec\Common Client
    • HKEY_LOCAL_MACHINE\Software\Symantec\SymEvent
    • HKEY_LOCAL_MACHINE\System\CurrentControlSet\SymEvent

  30. If Symantec AntiVirus is the only Symantec program that is installed, go to the following key

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

  31. In the right pane, delete the ccApp value.
  32. In the right pane, delete the vptray value.
  33. Restart the computer.

Symantec AntiVirus server is now disabled, even though traces of it remain in the registry. These traces have little impact on how your computer operates. You do not need to remove them.


Remove Symantec AntiVirus from the Start menu and from the hard drive
After Symantec AntiVirus is disabled, you need to remove leftover files and shortcuts to the program.

To remove Symantec AntiVirus Server from the Start menu
  1. On the Windows taskbar, right-click Start, and then click Open All Users.
  2. Double-click Programs.
  3. Double-click Symantec Client Security.
  4. Do one of the following:
    • If more than one program is listed in this folder, right-click Symantec AntiVirus, and then click Delete.
    • If Symantec AntiVirus is the only program that is listed in this folder, right-click Symantec Client Security, and then click Delete.

  5. Exit Windows Explorer.

To remove Symantec AntiVirus Server from the hard drive
  1. On the Windows taskbar, click Start > Programs > Accessories > Windows Explorer.
  2. Open the Program Files folder.
  3. Right-click the SAV folder, and then click Delete.


    WARNING: Follow the next three steps only if the conditions that are described in the steps are met. These instructions affect registry entries that other Symantec products use. If you delete a key or value that another Symantec product uses, that product must be removed and installed again.


  4. If Symantec AntiVirus is the only Symantec product on your computer, delete the Symantec folder.
  5. Open the following folder:

    Program Files\Common Files\Symantec Shared

  6. If Symantec AntiVirus is the only Symantec product on your computer, delete the following folders:
    • Decomposers
    • SPBBC
    • SPManifests
    • SSC
    • VirusDefs

  7. Open the following folder:

    C:\Documents and Settings\All Users\Application Data\Symantec

  8. Delete the following folders:
    • Symantec AntiVirus Corporate Edition
    • Common Client

  9. Exit Windows Explorer.







Legacy ID



2006021614065648


Article URL http://www.symantec.com/docs/TECH101703


Terms of use for this information are found in Legal Notices