Skip to main content

Manually Remove McAfee MOVE

Use my script to automate it. Run Step 1, the server will reboot, then run step 2.

move_removal_step_1.bat

move_removal_step_2.bat

How to manually remove MOVE AntiVirus Multi-platform
Technical Articles ID: KB74700
Last Modified: 4/7/2017

Environment
McAfee Management for Optimized Virtual Environments (MOVE)
McAfee MOVE AntiVirus (AV) Multi-platform 3.6.x

For details of MOVE supported environments, see KB74865.
Summary
IMPORTANT:
• The preferred method for removing MOVE Multi-Platform is to use the Add/Remove programs option via the Windows Control Panel.
• Only try to manually remove MOVE AV if automatic removal is not an option or was unsuccessful.
• To manually remove MOVE Multi-Platform, use the procedure outlined in this article. You can automate this procedure by creating a script to remove the relevant registry keys. McAfee does not provide support for scripts.
Solution
To manually remove MOVE AV Multi-Platform:

CAUTION: This article contains information about opening or modifying the registry.
• The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
• Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see: http://support.microsoft.com/kb/256986.
• Do not run a REG file that is not confirmed to be a genuine registry import file.
NOTE: Administrators should use discretion when using the following procedure.
1. Disable the MOVE driver and remove services:
a. Log on as Administrator.
b. Click Start, Run, type CMD, and press ENTER.
c. Type the following command and press ENTER:

mvadm disable

d. Repeat the preceding step for each of the following commands:

mvadm config set IntegrityEnabled=0
sc stop mvagtsvc
sc stop mvagtdrv
sc delete mvagtsvc
sc delete mvagtdrv

  1. Delete the MOVE plug-in registry keys:
    a. Click Start, Run, type regedit and press ENTER.
    b. Locate and right-click the following registry keys, then select Delete:
    c. For 32-bit computers

    HKLM/SOFTWARE/McAfee/McTray/Plugins/MovePlugin
HKLM//SOFTWARE/Network Associates/ePolicy Orchestrator/Application Plugins/MOVEVOFF2000_WIN
HKLM//SOFTWARE/Network Associates/ePolicy Orchestrator/Application Plugins/MOVEVOFF2000

    d. For 64-bit computers

    HKLM/SOFTWARE/Wow6432Node/McAfee/McTray/Plugins/MovePlugin
HKLM//SOFTWARE/Wow6432Node/Network Associates/ePolicy Orchestrator/Application Plugins/MOVEVOFF2000_WIN]
HKLM//SOFTWARE/Wow6432Node/Network Associates/ePolicy Orchestrator/Application Plugins/MOVEVOFF2000

  2. Restart your computer.

  3. Delete folders and files:
    a. Launch Windows Explorer.
    b. Delete the following folder and file:
    c. For 32-bit computers
    d. C:\Program Files\McAfee\MOVE AV Agent
    e. C:\Windows\System32\drivers\mvagtdrv.sys
    f. For 64-bit computers
    g. C:\Program Files (x86)\McAfee\MOVE AV Agent
    h. C:\Windows\SysWOW64\drivers\mvagtdrv.sys

  4. Delete the MOVE registry keys:
    a. Open the registry editor. Click Start, Run, type regedit, and press ENTER.
    b. For 32-bit and 64-bit computers:
    i. Locate and right-click the following registry key, then select Delete:

HKLM/\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\EBC5E19290CDCA843B6F91793B119366

ii. Repeat the preceding step for the following registry keys:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\4927166E1E17E3749947A91824D14211
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{291E5CBE-DC09-48AC-B3F6-1997B3113966}HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MOVE AV Agent
HKEY_CLASSES_ROOT\Installer\Products\EBC5E19290CDCA843B6F91793B119366
HKCR\Installer\Features\EBC5E19290CDCA843B6F91793B119366
HKCR\Installer\UpgradeCodes\4927166E1E17E3749947A91824D14211

iii. Locate the following registry key:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders

iv. Delete the following value:

C:\Program Files (x86)\McAfee\MOVE AV Agent\

v. Locate the following registry key:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components

vi. Search the key for the following string:

EBC5E19290CDCA843B6F91793B119366

vii. Delete each key that contains this string value.

c. For 64-bit computers only, locate and right-click the following registry key, then select Delete:

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{291E5CBE-DC09-48AC-B3F6-1997B3113966}

d. Close the registry editor.

Disclaimer
The content of this article originated in English. If there are differences between the English content and its translation, the English content is always the most accurate. Some of this content has been provided using Machine Translation translated by Microsoft.

Original Article

No comments to display

Back to top