5 Replies Latest reply on Apr 23, 2008 1:37 AM by matrixman

    Problem to reinstall the epo 3.6 agent, service won´t install/start

      Hello

      I have some clients that can´t install the epo agent 3.6, the mcafeeframework service is either not installed or can´t be started.

      I have tried to manually remove all installation folders in C:\Documents and Settings\All Users\Application Data\McAfee and c:\Program\McAfee. I have also made the changes to the registry according to the article 9611891. But when i´m trying to proceed with a manually installation of the epo client the files are created in the above mentioned folders but the mcafeeframework service can´t be installed/started.

      The log on the client complains about some string that is not correct.

      [Unable to open C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\FrameworkManifest.xml. Therefore CMA is not installed.
      HKLM\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent is not present. Therefore the 2.x agent is not installed.]

      After this i have tried to manually export working reg key from another pc, then the service shows up but can´t be started due of: The service cannot be enabled, error 5 (access is denied, local pc)

      I would really appreciate some help, does anyone have some suggestions how to proceed?

      Best regards Oskar
        • 1. RE: Problem to reinstall the epo 3.6 agent, service won´t install/start
          metalhead
          Do you have VSE8.5i installed ? Then you have to disable the Access protection before running an agent install locally.
          • 2. RE: Problem to reinstall the epo 3.6 agent, service won´t install/start
            Hello

            Thanks for the reply.

            The VSE8.5i was installed but it´s currently not. For what i can found from the log using the virtual technichian there are several missing com dll´s and a problem to start the service.

            I have tried to import the registry keys from a working pc. Also copied all the files from the c:\program\mcafee from the same pc. Then i tried to reregister the dll´s suggested in the mc knowledge article. But i still have problems to get the installation of the epo agent up and running.

            I guess that there be must be a way to completely remove the old installations and start all over? Are there any more reg keys/files that i should have a look at exept the ones below?


            Registry keys:
            HKLM\SOFTWARE\Mcafee\Network Associates\ePolicy Orchestrator
            HKLM\\SOFTWARE\Network Associates
            HKLM\System\currentcontrolset\services\mcafeeframework\
            HKLM\System\currentcontrolset001\services\mcafeeframework\
            HKLM\System\currentcontrolset003\services\mcafeeframework\

            Files:[All Users \Application Data\Network Associates\Common Framework] and [program mcafee]

            Best Regards Oskar
            • 4. RE: Problem to reinstall the epo 3.6 agent, service won´t install/start
              Hello

              I have already had a look at this but it didn´t solve my problem.
              Does anyone have anything to suggest in this case, i´m really stuck with this one...

              Best regards
              Oskar
              • 5. Manual Uninstall Instructions for CMA Agent
                Here are the instructions I have:

                There are times when a manual uninstall procedure will be required for the Common Management Agent.

                This will include instances where:

                *
                Upgrades fails leaving mismatched files that breaks CMA and stops the /Forceuninstall.from removing the CMA
                *
                Issue with VirusScan Enterprise 8.5 Prevent McAfee services from being stopped
                *
                Corruption of files previously installed CMA prior to upgrade
                *
                3rd part conflicts
                With the release of McAfee VirusScan 8.5i (VSE8.5i) and its Access Protection option (Prevent McAfee services from being stopped) means that several VSE8.5i scenarios have to be considered when trying to remove the Common Management Agent.

                NOTE: This is not an issue when VSE8.0i is installed.

                Scenarios to consider:

                1.
                VSE8.5i is currently installed (standalone install or when managed by ePolicy Orchestrator)
                See Solution 1


                2.
                VSE8.5i was installed and then uninstalled while Prevent McAfee services from being stopped was enabled.
                See Solution 2


                3.
                VSE8.5i was installed and then uninstalled while Prevent McAfee services from being stopped was disabled or VSE8.5i was never installed.
                See Solution 3
                NOTE: This solution can also be applied if you are running VSE7.1 or VSE8.0i.


                ________________________________

                Solution 1 - Disable either locally or via ePO the option - Prevent McAfee services from being stopped

                With VSE8.5 still installed, disable the option Prevent McAfee services from being stopped. With this option disabled it will be possible to remove the Common Management Agent (CMA) using either the frminst.exe /forceuninstall or the manual uninstall procedure Solution 4.

                Step 1 - If VSE8.5i is not managed by ePO/PRP.

                Disable the option: Prevent McAfee services from being stopped:

                1.
                Click, Start, Programs, McAfee, VirusScan Console.
                2.
                Right-click on Access Protection and select Properties.
                3.
                Deselect Prevent McAfee services from being stopped.
                4.
                Click Apply.
                5.
                Close the VirusScan Console.
                6.
                Now follow the steps in Step 2.

                If VSE8.5 is ePO managed

                Log on to the ePO console and disable the option Prevent McAfee services from being stopped:

                1.
                Click Start, Programs, McAfee, ePolicy Orchestrator 3.6.x Console.
                2. Select the directory or machine level the VSE8.5i policy will changed.
                3.
                In the right pane expand the Virus Enterprise 8.5.0 policy.
                4.
                Click Edit next to Access Protection Policies.
                5.
                Click the Access Protection tab.
                6.
                Deselect Prevent McAfee services from being stopped.
                7.
                Click Apply.
                8.
                Send an Agent Wakeup Call to to apply changes or wait for the next enforce policy to take effect.
                9.
                Close the ePO Console.

                Step 2 - Try to remove CMA using frminst.exe /forceuninstall

                This procedure should be attempted before having to use the manual uninstall procedure in Solution 4:

                1.
                Click Start, Run and type one of the following commands:


                *
                c:\Program Files\Network Associates\Common Framework\frminst.exe /forceuninstall
                *
                c:\Program Files\McAfee\Common Framework\frminst.exe /forceuninstall

                NOTE:The path will vary depending on the version, upgrade or clean install. Use Windows Explorer to determine the correct path.



                2.
                Restart the system to remove CMA processes from memory and complete deletion of files.


                Step 3 - Manual removal if Step 2 fails.

                If the above frminst.exe /forceuninstall fails to uninstall, then follow manual uninstall procedure in Solution 4.


                ________________________________

                Solution 2 - VSE8.5i was installed and then uninstalled while Prevent McAfee services from being stopped was enabled.

                If VirusScan 8.5i was installed and uninstalled with the option Prevent McAfee services from being stopped enabled the services protection is not removed during the uninstall. This will cause any attempt to uninstall the CMA component to fail. Therefore it is necessary to first reinstall VSE8.5 to resolve this. If reinstalling VSE8.5i is not an option follow Solution 4.

                Step 1

                1.
                Install VirusScan Enterprise 8.5i
                2.
                Disable the option Prevent McAfee services from being stopped
                NOTE: See Solution 1 for steps on how to achieve this.

                3.
                Uninstall VSE8.5i

                Step 2 - Try to remove CMA using frminst.exe /forceuninstall:

                1.
                Click Start, Run and type one of the following commands:
                .

                *
                c:\Program Files\Network Associates\Common Framework\frminst.exe /forceuninstall
                *
                c:\Program Files\McAfee\Common Framework\frminst.exe /forceuninstall

                NOTE: The path will vary depending on the version, upgrade or clean install. Use Windows Explorer to determine the correct path.



                2.
                Restart the system to remove CMA processes from memory and complete deletion of files.

                Step 3 - Manual removal if Step 3 fails.

                If the above frminst.exe /forceuninstall fails to uninstall, then follow manual uninstall procedure in Solution 4.


                ________________________________

                Solution 3 - VSE8.5i was installed and then uninstalled while Prevent McAfee services from being stopped was disabled or VSE8.5i was never installed.

                In this scenario VSE8.5i will pose no problem and allow the CMA to be removed using the simple procedure.

                Step 1 - Try to remove CMA using frminst.exe /forceuninstall:

                1.
                Click Start, Run and type one of the following commands (depending on the installation directory of the Agent):

                2.

                * c:\Program Files\Network Associates\Common Framework\frminst.exe /forceuninstall
                *
                c:\Program Files\McAfee\Common Framework\frminst.exe /forceuninstall

                NOTE: The path will vary depending on the version, upgrade or clean install. Use Windows Explorer to determine the correct path.



                3.
                Restart the system to remove CMA processes from memory and complete deletion of files.


                Step 2 - Manual removal if Step 1 fails.

                If the above frminst.exe /forceuninstall fails to uninstall then follow manual uninstall procedure in Solution 4.

                ________________________________

                Solution 4 - Manual removal procedure of CMA3.6.x

                If VSE8.5 was installed then make sure that the system has been rebooted.

                IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, see the following Microsoft Knowledge Base article:
                http://support.microsoft.com/kb/256986/EN-US/.

                Step 1 - If the McAfee Framework Service cannot be disabled then this has to be done via registry as all access to the service is denied due to self-protection:

                1.
                Click Start, Run..., type regedit.exe and click OK.
                2.
                Navigate to the following key: [HKLM\SYSTEM\CurrentControlSet\Services\McAfeeFramework]
                3.
                Double-click the Start value and set the value data to 4.
                4.
                Reboot the system, the McAfee Framework Service is now disabled.

                Step 2 - End all running CMA Processes:

                1.
                Press CTRL + ALT+ DEL to open the Task Manager.
                2.
                Click the Processes tab.
                3.
                Select the McTray.exe process and then click End Process. Click Yes when prompted.
                4.
                Select the UpdaterUI.exe process and then click End Process. Click Yes when prompted.
                5.
                Select the naPrdMgr.exe process and then click End Process. Click Yes when prompted.
                6.
                Close Task Manager.

                Step 3 - Registry edits:

                1.
                Click Start, Run..., type regedit.exe and click OK.
                2.
                Navigate to the following key: [HKLM\SYSTEM\CurrentControlSet\Services]
                3.
                Right-click on McAfeeFramework and select Delete.
                4.
                Also check for the existence of a McAfeeFramework sub-key (and delete them) under the following registry keys:



                *
                [HKLM\SYSTEM\ControlSet001\Services]
                *
                [HKLM\SYSTEM\ControlSet002\Services]
                *
                [HKLM\SYSTEM\ControlSetXXX\Services]



                5.
                Navigate to the following registry key:
                [HKLM\SOFTWARE\Network Associates\TVD\Shared Components\Framework]


                6.
                Make note of the Installed Path and the Data Path values.
                7.
                Delete the two folders mentioned in the above registry values.
                8.
                Navigate to the following key: [HKLM\SOFTWARE\Network Associates\TVD\Shared Components]
                9.
                Right-click Framework and select Delete.
                10.
                Navigate to the following key: [HKLM\SOFTWARE\McAfee\McTray]
                11.
                Right-click McTray and select Delete.
                12.
                Reboot the system.