Manually uninstalling Symantec AntiVirus 10.2 client

Article:TECH102050  |  Created: 2006-01-16  |  Updated: 2010-08-13  |  Article URL http://www.symantec.com/docs/TECH102050
Article Type
Technical Solution


Environment

Issue



This document describes how to manually uninstall Symantec AntiVirus 10.2 client from Windows Vista.


Solution



This procedure involves the following five steps:

  • Disable Tamper Protection.
  • Close or stop Symantec AntiVirus programs.
  • Stop Symantec AntiVirus services.
  • Remove Symantec AntiVirus from the registry.
  • Remove Symantec AntiVirus from the Start menu and from the hard drive.


Make sure that Symantec AntiVirus is not running before you start this procedure.


Disable Tamper Protection
You must disable Tamper Protection before you stop Symantec AntiVirus services.

To disable Tamper Protection

  1. Start Symantec AntiVirus.
  2. On the Configure menu, click Tamper Protection.
  3. Uncheck Enable Tamper Protection.
  4. Click OK.
  5. Click Exit.

 


Note: You must have administrator permissions in order to terminate processes and stop services.




End Symantec AntiVirus processes
You must end the following processes before you can continue:

  • ccApp.exe
  • Vptray.exe


To end the processes

  1. On the Windows taskbar, click Start > Run.
  2. In the Open box, type the following text:

    taskmgr.exe
  3. On the Processes tab, right-click ccApp.exe, and then click End Process.
  4. Right-click Vptray.exe, and then click End Process.



Stop Symantec AntiVirus services
You must stop the following services before you remove items from the registry, the Start menu, or the hard drive.

  • SavRoam
  • Symantec AntiVirus
  • DefWatch
  • ccEvtMgr
  • ccSetMgr



To stop the services

  1. On the Windows taskbar, click Start > Run.
  2. In the Open box, type the following text:

    services.msc
  3. Click OK.
  4. For each of the following services, right-click the name of the service, and then click Stop:
    • SavRoam (if running)
    • Symantec AntiVirus
    • DefWatch
    • ccEvtMgr
    • ccSetMgr



Remove Symantec AntiVirus from the registry
Most of the items that you must remove are entries in the Windows registry.


Note: You must have administrator permissions (read and write) to edit the registry.


 


WARNING: In the next steps you will edit the Windows registry. Back up the registry before you make any changes to it, because incorrect changes to the registry can result in permanent data loss or corrupted files. Modify only the registry keys that are specified.
For instructions, see How to back up the Windows registry.




To remove Symantec AntiVirus from the registry

  1. On the Windows taskbar, click Start > Run.
  2. In the Open box, type the following text:

    regedit
  3. Click OK.
  4. Expand the following key:

    HKEY_CLASSES_ROOT\Installer\Features

    This key contains many <Package Code> keys.

  5. Click each <Package Code> key, and look in the right pane for references to SAVMain.
    If you see any references to SAVMain in the right pane, then delete the entire <Package Code> key.

  6. Expand the following key:

    HKEY_CLASSES_ROOT\Installer\Products

    This key contains many <Package Code> keys.

  7. Click each <Package Code> key, and look in the right pane for references to Symantec AntiVirus.
    If you see any references to Symantec AntiVirus in the right pane, then delete the entire <Package Code> key.

  8. Delete the following key:
    HKEY_CLASSES_ROOT\*\Shellex\ContextMenuHandlers\LDVPMenu
  9. Expand the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products

    This key contains many <Package Code> keys.

  10. Expand each <Package Code> key, and then click the InstallProperties key.
    If you see any references to Symantec AntiVirus in the right pane, then delete the entire <Package Code> key.

  11. Expand the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

    This key contains many <Package Code> keys.

  12. Click each <Package Code> key, and look in the right pane for references to Symantec AntiVirus.
    If you see any references to Symantec AntiVirus in the right pane, then delete the entire <Package Code>  key.

  13. Delete the following keys if they exist:
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\20A7FB42A06BB49448A397B3CB77ED4D
    HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\DllUsage\VP6
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\20A7FB42A06BB49448A397B3CB77ED4D
  14. Do one of the following:
    • If you are certain that you do not need any Symantec software on the computer, then you can safely delete the entire Symantec key:
      HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\
    • If there is other Symantec software on the computer or you are not certain whether there is or not, then delete the following keys:
      HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SPBBC
      HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec AntiVirus
      HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SymNetDrv
      HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SRTSP
      HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SymEvent
  15. Delete the following keys:
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\System\SRTSP
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\System\SRTSPL
  16. Expand the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features

    This key contains many <Package Code> keys.

  17. Click each <Package Code> key, and look in the right pane for references to SAVMain.
    If you see any references to SAVMain in the right pane, then delete the entire <Package Code> key.

  18. Expand the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products

    This key contains many <Package Code> keys.

  19. Click each <Package Code> key, and look in the right pane for references to Symantec AntiVirus.
    If you see any references to Symantec AntiVirus in the right pane, then delete the entire <Package Code> key.

  20. Click the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  21. In the right pane, delete the vptray value.
  22. If Symantec AntiVirus is the only Symantec program that is installed, delete the ccApp value.
  23. Click the following key if it still exists:

    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps
  24. In the right pane, delete the following values:
    • SymNetDrv
    • Common Client Decomposers
    • SRTSP
    • SRTSPQuarantine
    • Savrt
    • SAV Install Directory
    • SAVCE
    • VP6ClientInstalled
    • SPBBC
    • Symantec Shared Directory
    • AMSUsageCount
    • VP6UsageCount
    • Common Client
    • Common Client Data
    • AVENGEDEFS
  25. Expand the following key:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
  26. Delete the following subkeys:
    • ccEvtMgr
    • ccSetMgr
    • DefWatch
    • NAVENG
    • NAVEX15
    • SavRoam
    • SRTSP
    • SRTSPL
    • SRTSPX
    • SymEvent
    • SNDSrvc
    • SPBBCDrv
    • Symantec AntiVirus
    • SYMREDRV
    • SYMTDI
  27. Expand the following key

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\Application
  28. Delete the following subkeys:
    • ccSvcHst
    • DefWatch
    • LiveUpdate
    • SavRoam
    • Symantec AntiVirus



      WARNING: Follow the next two steps only if the conditions that are described in the steps are met. These instructions affect registry entries that other Symantec products use. If you delete a key or value that another Symantec product uses, that product must be removed and installed again.


  29. If no other Symantec application that uses virus definitions is installed, then delete the following key, if it still exists:

    HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs
  30. If Symantec AntiVirus is the only Symantec application on the computer, delete the following keys, if they still exist:

    HKEY_LOCAL_MACHINE\Software\Symantec\Common Client
    HKEY_LOCAL_MACHINE\Software\Symantec\SymEvent
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SymEvent
  31. In the left pane, click My Computer.
  32. On the Edit menu, click Find.
  33. In the Find what box, type the following text:

    vpshell2.dll

    Delete all keys on the left side that contain this phrase in them.
  34. Delete entries on the right side pane that contain this string.
  35. Restart the computer.


Symantec AntiVirus client is now disabled, even though traces of it remain in the registry. These traces have little impact on how your computer operates. You do not need to remove them.


Remove Symantec AntiVirus from the Start menu and from the hard drive
After Symantec AntiVirus is disabled, you need to remove leftover files and shortcuts to the program.

To remove Symantec AntiVirus from the Start menu

  1. On the Windows taskbar, right-click Start, and then click Open All Users.
  2. Double-click Programs.
  3. Double-click Symantec Client Security.
  4. Do one of the following:
    • If more than one program is listed in this folder, right-click Symantec AntiVirus, and then click Delete.
    • If Symantec AntiVirus is the only program that is listed in this folder, right-click Symantec Client Security, and then click Delete.
  5. Exit Windows Explorer.


To remove Symantec AntiVirus from the hard drive

  1. In Windows Explorer, open the Program Files folder.
  2. Right-click the Symantec AntiVirus folder, and then click Delete.

    WARNING: Follow the next three steps only if the conditions that are described in the steps are met. These instructions affect registry entries that other Symantec products use. If you delete a key or value that another Symantec product uses, that product must be removed and installed again.

  3. If Symantec AntiVirus is the only Symantec product on your computer, delete the Symantec folder.
  4. Restart the computer.
  5. In Windows Explorer, open the Program Files\Common Files\Symantec Shared folder.
  6. If Symantec AntiVirus is the only Symantec product on your computer, delete the following folders:
    • Decomposers
    • SPBBC
    • SPManifests
    • SSC
  7. Open the ProgramData\Symantec folder.
  8. Delete the following folders:
    • Common Client
    • Definitions
    • LiveUpdate
    • SPBBC
    • SRTSP
    • Symantec AntiVirus Corporate Edition
    • SymNetDrv
  9. Exit Windows Explorer.






Legacy ID



2006111618085848


Article URL http://www.symantec.com/docs/TECH102050


Terms of use for this information are found in Legal Notices