How to remove McAfee Framework service when it resists (McAfee Enterprise edition, Win XP Home)

[summertan]

After removing McAfee from my NC10 with Add/Remove programs in Control Panel, I found out that the McAfee Framework service still runs. The program suggested in the NC10 tweaks thread to remove the Framework, namely the McAfee Consumer Products Removal tool (MCPR.exe) , didn’t work for me since it refuses to remove anything if one has McAfee Enterprise edition. So I had to look for other solutions.

Trying to stop the Framework service with administrator privileges in services.ms just lead to ‘access denied’ error. The problem is that the McAfee Virus Scan Enterprise (VSE) 8.5 has an Access Protection option that prevents McAfee services from being stopped. If that option was selected at the time of uninstall of VSE8.5, it will remain in effect for the Framework service, wich means that even admistrator account won’t be able to stop the Framework in the usual way.

I spent the whole day sifting internet and seeing the same problem reported over and over again with the same ‘solutions’ that don’t work because access is denied. Finally I bumped on the article below and only the last solution, which is a manual clean up of the windows Registry worked. It’s not as complicated as it seems if you had a little programming experience in Microsoft Visual C++ for example.

The article is

Quote:

article ID: KB55208
Manual uninstall procedure for Common Management Agent 3.6.0,
https://kc.mcafee.com/corporate/index?page=content&id=KB55208

The manual cleanup of Registry from the article that worked is (note that ‘HKLM’ is
‘HKEY_LOCAL_MACHINE’ on my netbook):

Quote:

Solution 4 – Manual removal procedure of CMA3.6.x

If VSE8.5 was installed then make sure that the system has been rebooted.

IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, see the following Microsoft Knowledge Base article:
http://support.microsoft.com/kb/256986/EN-US/.

Step 1 – If the McAfee Framework Service cannot be disabled then this has to be done via registry as all access to the service is denied due to self-protection:

Click Start, Run…, type regedit.exe and click OK.
Navigate to the following key: [HKLMSYSTEMCurrentControlSetServicesMcAfeeFramework]
Double-click the Start value and set the value data to 4.
Reboot the system, the McAfee Framework Service is now disabled.

Step 2 – End all running CMA Processes:
Press CTRL + ALT+ DEL to open the Task Manager.
Click the Processes tab.
Select the McTray.exe process and then click End Process. Click Yes when prompted.
Select the UpdaterUI.exe process and then click End Process. Click Yes when prompted.
Select the naPrdMgr.exe process and then click End Process. Click Yes when prompted.
Close Task Manager.

Step 3 – Registry edits:
Click Start, Run…, type regedit.exe and click OK.
Navigate to the following key: [HKLMSYSTEMCurrentControlSetServices]
Right-click on McAfeeFramework and select Delete.
Also check for the existence of a McAfeeFramework sub-key (and delete them) under the following registry keys:
[HKLMSYSTEMControlSet001Services]
[HKLMSYSTEMControlSet002Services]
[HKLMSYSTEMControlSetXXXServices]

Navigate to the following registry key:
[HKLMSOFTWARENetwork AssociatesTVDShared ComponentsFramework]

Make note of the Installed Path and the Data Path values.
Delete the two folders mentioned in the above registry values.
Navigate to the following key: [HKLMSOFTWARENetwork AssociatesTVDShared Components]
Right-click Framework and select Delete.
Navigate to the following key: [HKLMSOFTWAREMcAfeeMcTray]
Right-click McTray and select Delete.
Reboot the system.

After that I deleted the McAfee folder in Program Files manually. Before disabling the Framework service it was giving me ‘access denied’ error but now I deleted it without problem.

[clivers]

Did you actually install the enterprise version yourself?

The enterprise version can be uninstalled via the original installer program. so if you run setup of mcafee enterprise it gives you an uninstall option.

[summertan]

I can’t remember if the Enterprise was the one the came with the Sammy or I installed it later from my university software. Theoretically, Add/Remove program should call the McAfee unistaller that didn’t remove the Framework service so I had to do it manually.

[Author]

Posts