Manually uninstalling Symantec AntiVirus Server 8.x from Windows NT/2000/XP/2003

Article:TECH99848  |  Created: 2002-01-08  |  Updated: 2005-01-14  |  Article URL http://www.symantec.com/docs/TECH99848
Article Type
Technical Solution


Environment

Issue



Due to an error or some other reason, you need to uninstall Symantec AntiVirus Server 8.x manually.


Solution



This document describes how to manually remove Symantec AntiVirus Server 8.x from the following three places:
  • The registry
  • The Start menu
  • The hard drive

Stop the following services before removing items from the registry, Start menu, or hard drive.
  • DefWatch
  • Intel Alert Handler
  • Intel Alert Originator
  • Intel File Transfer
  • Intel PDS
  • Symantec AntiVirus Server

Manually removing registry entries

WARNING: We strongly recommend that you back up the registry before making any changes. Incorrect changes to the registry could result in permanent data loss or damaged files. Make sure that you modify only the keys specified. Read the document How to back up the Windows registry and How to use the Windows Registry editor before proceeding.
Note: You must have administrator permissions (read and write) to edit the registry.



To edit the registry
  1. Navigate to the following key in the left pane:

    HKEY_CLASSES_ROOT\*\Shellex\ContextMenuHandlers
  2. Right-click the LDVPMenu entry, and then click Delete.
  3. Navigate to the following key, and then delete the Norton AntiVirus NT folder.

    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Norton AntiVirus NT
  4. Navigate to the following key in the left pane:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
  5. Delete the following entries:
    • DefWatch
    • Intel Alert Handler
    • Intel Alert Originator
    • Intel File Transfer
    • Intel PDS
    • NAVAP
    • NAVAPEL
    • NAVENG
    • NAVEX15
    • Norton AntiVirus Server
  6. Navigate to any existing "ControlSet*"\Services keys and delete the same entries.
  7. Delete the SymEvent keys ONLY if Symantec AntiVirus 8.0 is the only Symantec program installed.
  8. Navigate to the following key in the left pane:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\Application
  9. Delete the following entries:
    • Defwatch
    • Intel Alert Handler
    • Intel Alert Originator
    • Intel AMS II
    • Intel File Transfer Service
    • Intel PDS Service
    • Norton AntiVirus
  10. Navigate to any existing "ControlSet*"\Services\EventLog\Application keys, and delete the same entries.
  11. Navigate to the following key in the left pane:

    HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\DllUsage
  12. Delete the VP6 key ONLY; do not delete the Intel folder (see warning below).


    WARNING: Be careful not to delete the Intel folder because other programs or hardware might be using this key.

  13. In the left pane, select My Computer, and then on the Edit menu, click Find.
    Search for "VirusProtect6" and delete all entries of this key.
  14. In the left pane, select My Computer, and then on the Edit menu, click Find.
    Search for AC68B2D7D5D2E96429DE5EB626DBD1C3. Delete all entries found.


    WARNING: Follow the next two steps only if no other Symantec applications use virus definitions on the computer. If there are applications using virus definitions when the SharedDefs key is deleted, they will have to be uninstalled and reinstalled in order to function.

  15. If no other Symantec applications that use virus definitions are installed, navigate to the HKEY_LOCAL_MACHINE\Software\Symantec key. Otherwise, skip to step 17.
  16. Delete the SharedDefs entry.
  17. Navigate to the following key in the left pane:

    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps
  18. Delete the following entries:
    • VP6ClientInstalled
    • VP6UsageCount
  19. Navigate to the following key in the left pane:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  20. Delete the {7D2B86CA-2D5D-469E-92ED-E56B62BD1D3C} key.
  21. Navigate to the following key in the left pane:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  22. Delete the vptray key.
  23. Restart the computer.

Symantec AntiVirus Corporate Edition server is now disabled, even though traces of it remain in the registry. These traces have little impact on how your computer operates. It is not necessary to remove them.

To remove Symantec AntiVirus Server from the Start menu
  1. Right-click the Start button, and then click Open All Users.
  2. Double-click Programs.
  3. Right-click the Symantec Client Security folder, and then click Delete.


WARNING: If there is another Symantec program listed in this folder, browse into the folder, and delete only the "Symantec AntiVirus Server" icon.


To remove Symantec AntiVirus Server from the hard drive
  1. Click Start > Programs > Windows NT Explorer.
  2. Navigate to the Program Files folder.
  3. Delete the SAV or NAV folder.


    WARNING: Follow the next three steps only if Symantec AntiVirus is the only Symantec application installed. If the VirusDefs folder is deleted while there are other Symantec applications using virus definitions, they must be uninstalled and reinstalled in order for them to function.

  4. If Symantec AntiVirus is the only Symantec product on your computer, delete the Symantec folder.
  5. Navigate to the Program Files\Common Files\Symantec Shared folder.
  6. If Symantec AntiVirus is the only Symantec product on your computer, delete the VirusDefs folder.
  7. Navigate to the folder appropriate to your operating system:
    • Windows 2000/XP
      C:\Documents and Settings\All Users\Application Data\Symantec
    • Windows NT 4.0
      C:\Winnt\Profiles\All Users\Application Data\Symantec
  8. Delete the Norton AntiVirus Corporate Edition folder.
  9. Close Windows Explorer.






Legacy ID



2002080812501648


Article URL http://www.symantec.com/docs/TECH99848


Terms of use for this information are found in Legal Notices