Expert: Brian Benosky - 3/17/2009

Question
QUESTION: Hi Brian,

I am trying to install McAfee Antivirus and it says that I need to uninstall another ant-virus program that came with the computer as OEM and has long expired. McAfee refers to it as: CA e-trust Antivirus.

The problem is I cannot locate this program either on my list, or when I go to Control Panel>Add/remove programs, nor can I see it when looking as Programs folder with Windows Explorer.

I even downloaded a free uninstall software (Perfect Uninstaller)and even that does not list this as a program.

Please tell me how I can find this program and uninstall it!

ANSWER: Hi Arshad

I'm not sure which version of CA you have, but the following will remove all traces from your computer.  Please read each step carefully:

1. Start->Run->and type in: unvet32.exe
Pay attention to what the uninstaller displays, if it can't remove
something you'll have to delete it manually.
2. Depending upon how badly the uninstaller failed after you've ran it
you "may" need to manually delete the following:
* C:\Windows\AVShlExt.dll
* C:\Windows\System32\ISafeIf.dll
* C:\Windows\System32\iSafProd.dll
* C:\Windows\System32\VetRedir.dll
* C:\Windows\System32\Drivers\VetEBoot.sys
* C:\Windows\System32\Drivers\VetEFile.sys
* C:\Windows\System32\Drivers\VetFDDNT.sys
* C:\Windows\System32\Drivers\Vet-Filt.sys
* C:\Windows\System32\Drivers\VetMonNT.sys
* C:\Windows\System32\Drivers\Vet-Rec.sys
* C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus
* The EZAV start menu program group located in Start->All Programs
* In the registry:
HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\Ant i-Virus

If EZAV is the only eTrust software you've ever installed it should be
safe to remove in the registry:
HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates

If you had to manually remove any files run UnVet32.exe again to see
what it displays. If it displays a successful message it will delete
itself, thus a complete uninstall.

credit: bigc73542 http://www.wilderssecurity.com/showthread.php?t=175239

Brian

---------- FOLLOW-UP ----------

QUESTION: Hi Brian,

Thanks- I did manage to remove the registry entry, but could not run unvet32.exe (did not recognise), nor did I find any of the files you have listed above. After re-booting, the problem persists.

Can you please make any further suggestions?

ANSWER: Hi Arshad

In the registry editor scroll to:

HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\

Delete ONLY the following keys:

VETEBOOT
VETEFILE
VETFDDNT
VET-FILT
VETMONNT
VETMSGNT
VET-REC

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURR ENTVERSION\UNINSTALL\

Delete ONLY the following key:

VETWIN32Vp5


Restart the PC.  Let me know if that worked.

Brian

---------- FOLLOW-UP ----------

QUESTION: Hi Brian,

Thanks again. Sorry, but I could not find any of the files you have listed above. I did find some CA listed files in the \services\ folder, which I deleted, rebooted, and the problem persists.

Any more suggestions? What excatly is the program unvet32.exe you refer to?


Answer
Hi Arshad

Unvet32.exe is the file name for the uninstall program for e-trust.  As you have seen, the program uninstaller does not work, or does not remove entries properly, for whatever reason.  I'd like to have a closer look as to what exactly is running on your system.  Please download HijackThis to your desktop from here:
http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
Make sure you close EVERY open window and ALL browser windows. The only thing that should be open is the HijackThis program.
Double-click on the file you just downloaded.
Click on the "Install" button.
Upon install, HijackThis should open for you.
Should it not open, go to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe
Choose 'Do a system scan and save a log file'.
Copy the text file which opens in Notepad and paste it in your next follow-up.
   * Do not fix any entries in HijackThis, as they may be harmless.


Brian