How to manually uninstall Symantec Endpoint Protection (SEP) client from Windows XP Professional x64 Edition

Article:TECH102287  |  Created: 2007-01-02  |  Updated: 2012-01-17  |  Article URL http://www.symantec.com/docs/TECH102287
Article Type
Technical Solution


Issue



This document describes how to manually remove the Symantec Endpoint Protection (SEP) client from Windows XP Professional x64 Edition.

 


Solution




 


Warning: These removal steps can disable any other Symantec products that are installed on the computer.
It is highly recommended that all Symantec products be uninstalled by using the Control Panel's "Add or Remove Programs" before starting this process.
 



To stop the Windows Installer service

  1. Click Start > Run.
  2. Type services.msc and click OK.
  3. Right-click Windows Installer, and then click Properties.
  4. Under Startup Type, click Disabled.
  5. Close the Services window.


To stop Symantec Endpoint Protection

  1. Click Start > Run.
  2. Type msconfig and click OK.
  3. On the Startup tab, uncheck ccapp.
  4. On the Services tab, uncheck the following:
    • Symantec Event Manager
    • Symantec Settings Manager
    • Liveupdate
    • Symantec Management Client
    • Symantec Network Access Control
    • Symantec Endpoint Protection
  5. Click OK.
  6. Restart the computer.
  7. After you restart the computer, a message appears. Check the box and click OK.

To remove the Teefer2 driver

  1. Click Start > Settings > Control Panel > Network Connections.
    You will need to repeat the following steps for each entry in Network Connections:
  2. Click a connection.
  3. In the dialog, click Properties.
  4. Select Teefer2 Driver and click Uninstall.
  5. Repeat with other connections as needed.
  6. Restart the computer.

To remove Symantec Endpoint Protection from the registry

  1. Click Start > Run.
  2. Type regedit and click OK.
  3. In the Windows registry editor, in the left pane, delete the following keys. If an entry is not present, skip to the next one.
    • HKEY_CLASSES_ROOT\*\Shellex\ContextMenuHandlers\LDVPMenu
    • HKEY_CURRENT_USER\Software\Symantec
    • HKEY_LOCAL_MACHINE\SOFTWARE\Sygate Technologies, Inc.
    • HKEY_LOCAL_MACHINE\SOFTWARE\Symantec
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SevInst
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ccEvtMgr
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ccSetMgr
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eeCtrl
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EraserUtilRebootDrv
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LiveUpdate
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SmcService
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNAC
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SnacNp
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SRTSP
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SRTSPL
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SRTSPX
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Symantec AntiVirus
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SymEvent
    • HKEY_LOCAL_MACHINE\SYSTEM\SYMANTEC
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ccEvtMgr
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ccSvcHst
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\LiveUpdate
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Symantec AntiVirus
    • HKEY_CLASSES_ROOT\TypeLib\{6F952B50-BCEE-11D1-82D6-00A0C9749EEF}
       
  4. Navigate to the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  5. Click the Uninstall key to select it.
  6. On the Edit menu, click Find.
  7. Type symantec, and click Find Next.
    You should see a value in the right pane that includes the word Symantec, in a key that is still in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall.
  8. If the key that is selected is still in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, delete the key (in the left pane), and then repeat the search from step 4. If the key that is selected is not in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, continue to the next step.
  9. Remove any values with "Symantec" in the path from the following keys:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SharedDlls
  10. Search for and delete all instances of the following strings:
    • 331D64B67B1D6024FAD99FA7FAAE8F32
    • vpshell2
  11. Restart the computer.

To remove Symantec Endpoint Security files and folders

  1. Delete the following files and folders. If a file or folder is not present, skip to the next one.
    • C:\Documents and Settings\All Users\Application Data\Symantec (Note: "Application Data" is a hidden folder)
    • C:\Documents and Settings\All Users\Start Menu\Programs\Symantec Endpoint Protection
    • C:\Program Files\Symantec
    • C:\Program Files\Common Files\Symantec Shared
    • C:\Program Files (x86)\Symantec
    • C:\Program Files (x86)\Common Files\Symantec Shared
    • C:\WINDOWS\system32\drivers\srtsp64.cat
    • C:\WINDOWS\system32\drivers\srtsp64.inf
    • C:\WINDOWS\system32\drivers\srtsp64.sys
    • C:\WINDOWS\system32\drivers\srtspl64.cat
    • C:\WINDOWS\system32\drivers\srtspl64.inf
    • C:\WINDOWS\system32\drivers\srtspl64.sys
    • C:\WINDOWS\system32\drivers\srtspx64.cat
    • C:\WINDOWS\system32\drivers\srtspx64.inf
    • C:\WINDOWS\system32\drivers\srtspx64.sys
    • C:\WINDOWS\system32\drivers\SYMEVENT64x86.CAT
    • C:\WINDOWS\system32\drivers\SYMEVENT64x86.INF
    • C:\WINDOWS\system32\drivers\SYMEVENT64x86.SYS
    • C:\WINDOWS\system32\drivers\WGX64.SYS
    • C:\WINDOWS\system32\drivers\WPSDRVnt.sys
    • C:\WINDOWS\system32\drivers\WpsHelper.sys
       
  2. Restart the computer.
  3. Delete the following file:
    • C:\WINDOWS\system32\sysfer.dll
  4. Go to C:\Windows\Installer.
  5. For each file in the C:\Windows\Installer folder, right click the file and click Properties.
  6. On the summary tab, check to see if the file was created by Symantec. If it was, delete the file.
    Repeat this for each file in the folder.
  7. Restart the computer.


To start the Windows Installer service

  1. Click Start > Run.
  2. Type services.msc and click OK.
  3. Right-click Windows Installer, and then click Properties.
  4. Under Startup Type, click Manual.
  5. Close the Services window.


References
This document is available in the following languages:




 



Legacy ID



2007080209320548


Article URL http://www.symantec.com/docs/TECH102287


Terms of use for this information are found in Legal Notices