How to remove McAfee remained files and registry keys

[shiwan0804]

Hi, everyone

I had used MCPR.exe to remove my McAfee products.

But, there were some files remained such as the picture of McAfee remained drivers.JPG.

The folder of these files located at C:\WINDOWS\system32\drivers.

They are McAfee leagcy drivers named as mfeapfk.sys, mfeavfk.sys, mfebopk.sys, mfehidk.sys, mferkdet.sys, mfetdi2k.sys, mfetdik.sys.

Q1. How can I delete the McAfee leagcy drivers safely?

My user account has computer administrator right, but it can't delete the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MCSHIELD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MCTASKMANAGER
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MFEAPFK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MFEAVFK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MFEBOPK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MFEHIDK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MFEHIDK01
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MFEHIDK02
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MFETDIK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MFEVTP

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MCSHIELD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MCTASKMANAGER
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MFEAPFK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MFEAVFK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MFEBOPK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MFEHIDK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MFEHIDK01
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MFEHIDK02
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MFETDIK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MFEVTP

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MCSHIELD

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MCTASKMANAGER
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MFEAPFK
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MFEAVFK
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MFEBOPK
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MFEHIDK
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MFEHIDK01
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MFEHIDK02
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MFETDIK
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MFEVTP

I had tried the safe mode to delete the aforementioned registry keys, but the keys still couldn't be deleted unfortunately.

The system said that the keys couldn't be deleted.

The statement such as the pictures named as ControlSet001 error.JPG, ControlSet001.JPG, ControlSet002.JPG, CurrentControlSet.JPG.

Q2. How can I delete the McAfee leagcy drivers registry key remained?

Q3. Can I just the McAfee leagcy drivers remained at device manager such as the picture named as device manager remained UPnP McAfee drivers.JPG?

[selvan]

Hi shiwan0804,

I presume that you do not want the Product to be installed in future. If Yes Proceed with the below steps.

In the Device Manager Screenshot above right click McAfee Inc mfeapfkb device and Select Uninstall. Similarly repeat for other McAfee devices as well and Restart the Computer once done.

Check if the files are Present. If Present then boot Windows into Safe Mode and login to the Administrator account that will pop up in Safe Mode alone.

Change Permissions of the folders you wish to delete. Click here to see how.

Try deleting the files and post back the status..!

[exbrit]

Also sometimes running MCPR again can have the desired effect.  But NOTE this only works with the regular consumer suites and NOT Anti-Theft or any Enterprise product.

Make sure MCPR is the latest download from here:  http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

Back to being unable to delete certain registry keys.  It would be possible to do so if you take ownership of them & give yourself the correct permissions.  But that is complicated and really the subject for help from an appropriate PC help forum.

.

Message was edited by: Ex_Brit on 23/02/14 7:45:54 EST AM

[shiwan0804]

Hi, everyone

I had used MCPR to remove McAfee product.

MCPR already helped me to delete the legacy driver in C:\WINDOWS\system32\drivers

and hidden in device manager.

The pictures attached are the conditions after using MCPR named as

McAfee remained drivers had deleted by MCPR.JPG,

device manager remained UPnP McAfee drivers had deleted by MCPR.JPG.

Unfortunately, the legacy drivers registry keys still remained such as LEGACY_MCTASKMANAGER,

LEGACY_MFEHIDK02, LEGACY_MFETDI2K, LEGACY_MFETDIK, LEGACY_MFEVTP.

I had login to Administrator in safe mode and tried to delete the registry keys above,

but the keys still couldn't be deleted.

The pictures attached are the conditions after using MCPR named as

ControlSet001 after MCPR was used.JPG, ControlSet002 after MCPR was used.JPG,

CurrentControlSet after MCPR was used.JPG, ControlSet001 error in safe mode.JPG.

Is there a official removal tool for enterprise product or not?

[exbrit]

MCPR does not remove Enterprise as I said and there are no removal tools for Enterprise at all.    Are we talking about Enterprise here?  What was the name of the McAfee product you are trying to remove?

Removing registry keys can lead you into trouble with your system so be very careful.   Any registry key can be deleted if you have the right permissions to do it, but that is, as I said earlier, complicated.

Please indicate if this was Enterprise because if so, this is in the wrong section. 

[shiwan0804]

Sorry, Ex_Brit.

My product is VSE 8.7. I think MCPR can help me to remove the registry keys,

therefore, I post the question in this section.

I think that it is a mistake seemingly.

I am very sorry.

Anyway, thanks for your help and Chinthanai Selvan P.

[exbrit]

No problem.  I have moved this to Business > VirusScan Enterprise for better support.   Hopefully someone will be able to help as MCPR from the consumer side cannot remove this product.

I also marked the thread as unanswered so it will attract more attention.   Good luck 😉

.

Message was edited by: Ex_Brit on 23/02/14 9:06:49 EST AM

[rmetzger]

Hi shiwan0804,

How to manually remove VirusScan Enterprise 8.7i:

Corporate KnowledgeBase ID:

KB59996

https://kc.mcafee.com/corporate/index?page=content&id=KB59996

This should list most of what you are looking for on how to manually remove any remnants of VSE v8.7i from your system.

Good luck,

Ron Metzger

[shiwan0804]

Thanks, rmetzger

I had used the way of this article to remove VSE 8.7 manually.

Unfortunately, the registry keys still remained as follow:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MCSHIELD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MCTASKMANAGER
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MFEAPFK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MFEAVFK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MFEBOPK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MFEHIDK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MFEHIDK01
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MFEHIDK02
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MFETDIK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MFEVTP

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MCSHIELD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MCTASKMANAGER
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MFEAPFK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MFEAVFK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MFEBOPK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MFEHIDK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MFEHIDK01
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MFEHIDK02
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MFETDIK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MFEVTP

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MCSHIELD

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MCTASKMANAGER
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MFEAPFK
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MFEAVFK
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MFEBOPK
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MFEHIDK
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MFEHIDK01
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MFEHIDK02
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MFETDIK
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MFEVTP

[rmetzger · Accepted solution]

Hi shiwan0804,

To remove these entries, you may not have the proper 'Permissions' which stops you from deleting these registry keys.

In RegEdit, drill down to the key, and right-click on the key and select 'Permissions...' If you are an Administrator, you should be able to Add your ID and give yourself 'Full Control' of the key. You should then be able to delete the key.

Hope that helps.

Ron Metzger