How to manually remove Symantec AV 10 client

Well, I have a friend who got fired from his job.  His job forgot to obtain a company issued laptop so he asked me to fix it up for him.  Since they gave him local admin rights, I figured I would spoof up the OS a bit.  The first issue I noticed was that symantec was broken.  I found the following kB article from symantec and ran through this without any issues.  Its a bit tedious, but hell, its worth it!

To remove Symantec AntiVirus from the registry

1. On the Windows taskbar, click Start > Run.
2. In the Open box, type the following text:

   regedit

3. Click OK.
4. In the Windows Registry Editor, in the left pane, go to the following key:

   HKEY_CLASSES_ROOT\*\Shellex\ContextMenuHandlers

5. In the left pane, right-click LDVPMenu, and then click Delete.
6. Expand the following key:

   HKEY_CLASSES_ROOT\Installer\Features

   This key contains many <Package Code> keys.

7. Click each <Package Code> key, and look in the right pane for references to SAVMain.
   If you see any references to SAVMain in the right pane, then delete the entire <Package Code> key.
8. Expand the following key:

   HKEY_CLASSES_ROOT\Installer\Products

   This key contains many <Package Code> keys.

9. Click each <Package Code> key, and look in the right pane for references to Symantec AntiVirus.
   If you see any references to Symantec AntiVirus in the right pane, then delete the entire <Package Code> key.
10. Expand the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products

    This key contains many <Package Code> keys.

11. Expand each <Package Code> key, and then click the InstallProperties key.
    If you see any references to Symantec AntiVirus in the right pane, then delete the entire <Package Code> key.
12. Expand the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

    This key contains many <Package Code> keys.

13. Click each <Package Code> key, and look in the right pane for references to Symantec AntiVirus.
    If you see any references to Symantec AntiVirus in the right pane, then delete the entire <Package Code> key.
14. Delete the following keys:
    • HKEY_CLASSES_ROOT\Installer\UpgradeCodes\20A7FB42A06BB49448A397B3CB77ED4D
    • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\20A7FB42A06BB49448A397B3CB77ED4D
    • HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\DllUsage\VP6
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\20A7FB42A06BB49448A397B3CB77ED4D
    • HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SPBBC
    • HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec AntiVirus
    • HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SymNetDrv
    • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\System\SAVRT
15. Expand the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features

    This key contains many <Package Code> keys.

16. Click each <Package Code> key, and look in the right pane for references to SAVMain.
    If you see any references to SAVMain in the right pane, then delete the entire <Package Code> key.
17. Expand the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products

    This key contains many <Package Code> keys.

18. Click each <Package Code> key, and look in the right pane for references to Symantec AntiVirus.
    If you see any references to Symantec AntiVirus in the right pane, then delete the entire <Package Code> key.
19. Click the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

20. In the right pane, delete the vptray value.
21. Click the following key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps

22. In the right pane, delete the following values:
    • AVENGEDEFS
    • Common Client
    • Common Client Data
    • Common Client Decomposers
    • NAVNT
    • SAV Install Directory
    • SAVCE
    • Savrt
    • SPBBC
    • SymNetDrv
    • VP6ClientInstalled
    • VP6UsageCount
23. Expand the following key:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

24. Delete the following subkeys:
    • ccEvtMgr
    • ccSetMgr
    • DefWatch
    • NAVENG
    • NAVEX15
    • SavRoam
    • SAVRT
    • SAVRTPEL
    • SNDSrvc
    • SPBBCDrv
    • SPBBCSvc
    • Symantec AntiVirus
    • SYMREDRV
    • SYMTDI
25. Expand the following key:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\Application

26. Delete the following subkeys:
    • ccEvtMgr
    • ccSetMgr
    • DefWatch
    • LiveUpdate
    • SavRoam
    • Symantec AntiVirus
27. In the left pane, click My Computer.
28. On the Edit menu, click Find.
29. In the Find what box, type the following text:

    VirusProtect6

    Delete all keys and values that contain this string.

30. In the left pane, click My Computer.
31. On the Edit menu, click Find.
32. In the Find what box, type the following text:

    vpshell2.dll

    Delete all keys and values that contain this string.

33. In the left pane, click My Computer.
34. On the Edit menu, click Find.
35. In the Find what box, type the following text:

    933187C5788574F4889B3B1FBB35638A

    Delete all keys and values that contain this string.

    ---

    WARNING: Follow the next four steps only if the conditions that are described in the steps are met. These instructions affect registry entries that other Symantec products use. If you delete a key or value that another Symantec product uses, that product must be removed and installed again.

    ---

36. If no other Symantec application that uses virus definitions is installed, then delete the following key:

    HKEY_LOCAL_MACHINE\Software\Symantec\SharedDefs

37. If Symantec AntiVirus is the only Symantec program that is installed, delete the following keys:
    • HKEY_LOCAL_MACHINE\Software\Symantec\Common Client
    • HKEY_LOCAL_MACHINE\Software\Symantec\SymEvent
    • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SymEvent
38. If Symantec AntiVirus is the only Symantec program that is installed, go to the following key

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

39. In the right pane, delete the ccApp value.
40. Restart the computer.

Symantec AntiVirus client is now disabled, even though traces of it remain in the registry. These traces have little impact on how your computer operates. You do not need to remove them.

Remove Symantec AntiVirus from the Start menu and from the hard drive
After Symantec AntiVirus is disabled, you need to remove leftover files and shortcuts to the program.

To remove Symantec AntiVirus from the Start menu

1. On the Windows taskbar, right-click Start, and then click Open All Users.
2. Double-click Programs.
3. Double-click Symantec Client Security.
4. Do one of the following:
   • If more than one program is listed in this folder, right-click Symantec AntiVirus, and then click Delete.
   • If Symantec AntiVirus is the only program that is listed in this folder, right-click Symantec Client Security, and then click Delete.
5. Exit Windows Explorer.

To remove Symantec AntiVirus from the hard drive

1. On the Windows taskbar, click Start > Programs > Accessories > Windows Explorer.
2. Open the Program Files folder.
3. Right-click the Symantec Client Security folder, and then click Delete.
   

   ---

   WARNING: Follow the next three steps only if the conditions that are described in the steps are met. These instructions affect registry entries that other Symantec products use. If you delete a key or value that another Symantec product uses, that product must be removed and installed again.

   ---

4. If Symantec AntiVirus is the only Symantec product on your computer, delete the Symantec folder.
5. Open the following folder:

   Program Files\Common Files\Symantec Shared

6. If Symantec AntiVirus is the only Symantec product on your computer, delete the following folders:
   • Decomposers
   • SPBBC
   • SPManifests
   • SSC
   • VirusDefs
7. Open the following folder:

   C:\Documents and Settings\All Users\Application Data\Symantec

8. Delete the following folders:
   • Common Client
   • Symantec AntiVirus Corporate Edition
9. Exit Windows Explorer.