Manually uninstall Endpoint Protection clients on Windows (2024)

Warning

The manual removal process can disable other Symantec products that are installed on the computer. We recommended that you use Add or Remove Programs when uninstalling Symantec software before starting this process.

Manual uninstall of SEP should only be attempted as a last resort if traditional removal by Add or Remove Programs fails. If that does not work, useCleanWipe.

Not all files, folders, registry keys, or registry values may be present on the computer. If an entry does not exist, move on to the next one.

Log on as Administrator

The Administrator account on Windows must be used to remove Symantec Endpoint Protection.

To enable the Administrator account, seeEnable and Disable the Built-in Administrator Account(Microsoft). When the Administrator account is enabled, log on using that account.

Back up the Windows registry

Before you begin this procedure, back up the Windows registry. SeeBack up the registry(Microsoft).

Allow Endpoint Protection services to be configured

1. Right-click the Symantec Endpoint Protection icon in the lower right corner of the screen, and clickOpen Symantec Endpoint Protection.
2. In the left pane, clickChange Settings.
3. In the right pane, clickClient Management>Configure Settings.
4. On the Tamper Protection tab, uncheckProtect Symantec security software from being tampered with or shut down.
5. ClickOK.
6. Close Symantec Endpoint Protection.

Stop Endpoint Protection

1. ClickStart>Run.
2. Typemsconfigand clickOK.
3. On the Services tab, uncheck the following (not all may be present):
   • Symantec Network Access Control
   • Symantec Endpoint Protection
4. ClickOK.
5. ClickStart>Run.
6. Typeregeditand clickOK.
7. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SepMasterService
8. Change the Start value to "4".
9. Repeat step 8 for the following keys:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNAC
10. Restart the computer.
11. After you restart the computer, a message appears. Check the box and clickOK.

Remove the Teefer driver (may not be present)

1. ClickStart>Run.
2. Typeregeditand clickOK.
3. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}
4. Find the keys that have a value of ComponentId that is set to symc_teefer2, and update the value of Characteristics to "40000".
5. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network
6. Delete the value named "Config".
7. Exit the Windows Registry Editor.
8. ClickStart>Settings>Control Panel>Network Connections.
9. Select a connection.
10. In the dialog box, clickProperties.
11. Select Symantec Endpoint Protection Firewall, and clickUninstall.
12. Repeat these steps for each network connection.
13. Restart the computer.

Remove Endpoint Protection from the registry

1. ClickStart>Run.
2. Typeregeditand clickOK.
3. In the Windows Registry Editor, in the left pane, delete the following keys if they are present. If one is not present, proceed to the next one.
   • HKEY_CURRENT_USER\Software\Symantec\Symantec Endpoint Protection
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BHDrvx86
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\IDSVix86
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NAVENG
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NAVEX15
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SepMasterService
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SmcService
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SNAC
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SnacNp
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SRTSP
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SRTSPX
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SyDvCtrl
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SymDS
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SymEFASI
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SymELAM
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SymEvent
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SymIRON
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SYMNETS
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SysPlant
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Teefer2
4. Go to HKEY_LOCAL_MACHINE\SOFTWARE, and delete the following keys if they are present:
   • \Microsoft\Security Center\Monitoring\SymantecAntiVirus
   • \Microsoft\Windows\CurrentVersion\App Paths\Smc.exe
   • \Microsoft\Windows\CurrentVersion\Controls Folder\Display\shellex\PropertySheetHandlers\LDVP Shell Extensions
   • \Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SEP
   • \Symantec\Symantec Endpoint Protection
   • \Microsoft\Windows\CurrentVersion\Uninstall\SevInst
5. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\InstalledApps, and delete the value SAVCE.
6. Go to HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432node, and delete the following keys if they are present:
   • \Microsoft\Security Center\Monitoring\SymantecAntiVirus
   • \Microsoft\Windows\CurrentVersion\App Paths\Smc.exe
   • \Microsoft\Windows\CurrentVersion\Controls Folder\Display\shellex\PropertySheetHandlers\LDVP Shell Extensions
   • \Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SEP
   • \Symantec\Symantec Endpoint Protection
   • \Microsoft\Windows\CurrentVersion\Uninstall\SevInst
   • \Microsoft\Windwos\CurrentVersion\Uninstall\SymcData-BASHDefs
   • \Microsoft\Windwos\CurrentVersion\Uninstall\SymcData-cndcipsdefs
   • \Microsoft\Windwos\CurrentVersion\Uninstall\SymcData-idsdefs
7. Go to HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432node\Symantec\InstalledApps, and delete the value SAVCE.
8. Go to HKEY_CLASSES_ROOT, and delete the following keys if they are present:
   • \*\Shellex\ContextMenuHandlers\LDVPMenu
   • \AppID\Cliproxy.dll
   • \AppID\HPPProtectionProviderUI.dll
   • \AppID\PatchWrap.exe
   • \AppID\ProtectionUtil.dll
   • \AppID\SavMainUI.dll
   • \AppID\SavUI.exe
   • \AppID\SmcGui.exe
   • \AppID\SymNAPSHAgent.dll
   • \AppID\{163A15AA-F8B0-4A44-8B5D-8C40F9B46E66}
   • \AppID\{2E259067-4D17-4873-9D0E-BC56A2A99124}
   • \AppID\{4D87269F-49AB-4095-93FF-52DAD221149E}
   • \AppID\{4E9AEDCC-5516-41CC-AF40-2740C2310662}
   • \AppID\{5C2FCE47-AC1E-43D5-8E5C-038570953896}
   • \AppID\{610056EB-8561-4720-9C05-8E8C368E8779}
   • \AppID\{6425FB43-BE2A-4AC9-9B70-1C18807882D1}
   • \AppID\{7F9D125B-D23F-4275-8656-931F712092A7}
   • \AppID\{CA39D995-ACA4-42B1-AABA-0C77EF20F785}
   • \cliproxy.objects
   • \cliproxy.objects.1
   • \Cliproxy.ScanManagerCOMCallback
   • \Cliproxy.ScanManagerCOMCallback.1
   • \CLSID\{083684A2-47AB-4839-A3B3-8109F4266B29}
   • \CLSID\{09FA8089-EE3E-4362-B8C0-1B0F4FD0505D}
   • \CLSID\{0E4ACE4C-DB4D-42C4-83A6-9A71D9C2CC1C}
   • \CLSID\{0F0E0EE0-760F-11D2-8E55-72C9EE000000}
   • \CLSID\{173883C3-C6CF-4D17-9889-CDC51DCFF5E1}
   • \CLSID\{17DE501A-6AD7-488C-9045-29FACC2262EF}
   • \CLSID\{1CDDD0B9-03AA-4442-9A5B-AC98086513E1}
   • \CLSID\{1FBEF3C8-45A0-42E0-8C68-681C4EB26DF7}
   • \CLSID\{26AFF61A-3282-4915-92C6-DCD3DB29BD5C}
   • \CLSID\{2AA55A10-1373-499B-8485-561006D1A1B0}
   • \CLSID\{2707AAC5-C268-11D1-8263-00A0C95C0756}
   • \CLSID\{2707AAC6-C268-11D1-8263-00A0C95C0756}
   • \CLSID\{28FE5CD9-272D-442D-BA16-822126FCBD00}
   • \CLSID\{2AE1F986-F3C3-4EF3-95DF-ED32AFE49510}
   • \CLSID\{2E76B2BF-C603-11D1-826C-00A0C95C0756}
   • \CLSID\{2E76B2C0-C603-11D1-826C-00A0C95C0756}
   • \CLSID\{2E76B2C3-C603-11D1-826C-00A0C95C0756}
   • \CLSID\{2E76B2C4-C603-11D1-826C-00A0C95C0756}
   • \CLSID\{314F8196-D31F-456B-BAA6-0A87FEEC20E4}
   • \CLSID\{327C5962-08E2-4EC6-A21A-340838D6EDB5}
   • \CLSID\{35AF7390-D827-4C1C-B7E0-8A26EC695AF5}
   • \CLSID\{3839D6F2-9AC5-4F95-9A47-504FB453ACBD}
   • \CLSID\{3DA06333-6CF3-499D-83AE-804CB32863AA}
   • \CLSID\{40C57BF5-CA86-11D1-B782-00A0C99C7131}
   • \CLSID\{40C57BF6-CA86-11D1-B782-00A0C99C7131}
   • \CLSID\{4128E694-4BB9-11D1-8190-00A0C95C0756}
   • \CLSID\{4128E695-4BB9-11D1-8190-00A0C95C0756}
   • \CLSID\{425DC6B2-28B6-41D2-AE94-0CE5E1CE7D9F}
   • \CLSID\{43943CCA-883C-11D1-83A4-00A0C9749EEF}
   • \CLSID\{4572031A-44ED-411B-9254-76449055D796}
   • \CLSID\{47D635E3-9D14-40C9-A28C-64C2AA7AF647}
   • \CLSID\{4B37F436-A1C7-43D6-8B48-2578BFB82F9C}
   • \CLSID\{4DEF8DD1-C4D1-11D1-82DA-00A0C9749EEF}
   • \CLSID\{501F9014-F64A-49AD-A36D-CB8F722D3739}
   • \CLSID\{536604C2-B82E-11D1-8252-00A0C95C0756}
   • \CLSID\{536604C3-B82E-11D1-8252-00A0C95C0756}
   • \CLSID\{57BAFF80-7818-4874-9D14-0AEC89E8E713}
   • \CLSID\{592DC44C-4977-11D1-818D-00A0C95C0756}
   • \CLSID\{592DC44F-4977-11D1-818D-00A0C95C0756}
   • \CLSID\{5CEC0E13-CF22-414C-8D67-D44B06420FC1}
   • \CLSID\{62C95F44-F1B4-4460-A190-E0402B887BFF}
   • \CLSID\{661CE64B-B9C4-40A0-A935-8A7A512CC794}
   • \CLSID\{66228C13-C5A0-4552-B1C0-5B6FDD59CCF7}
   • \CLSID\{6C393196-AEEB-4CB0-8F8E-72EFC4C2C1CA}
   • \CLSID\{6CAD485D-61FD-4989-8BE1-22BFDBD4260B}
   • \CLSID\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}
   • \CLSID\{6F129A02-26F1-4AFB-80C4-8D0073EA2679}
   • \CLSID\{72864BE2-6234-45AA-952D-00C10C34BEEE}
   • \CLSID\{72E2440E-EBEA-49E6-A185-1BE03F723E28}
   • \CLSID\{74F8002D-2DF2-479E-80B9-AF7AC93DF4A7}
   • \CLSID\{7F365837-F578-11D1-B7B2-00A0C99C7131}
   • \CLSID\{7F365838-F578-11D1-B7B2-00A0C99C7131}
   • \CLSID\{7FBB7DCB-FF3D-467E-8962-7F1F58DE5B50}
   • \CLSID\{84AC6BE7-8CF2-4E67-A80E-32ACD3D7C381}
   • \CLSID\{8630F7C0-73E6-4C27-80AF-6ED3A7152194}
   • \CLSID\{8BEEE74D-455E-4616-A97A-F6E86C317F32}
   • \CLSID\{8F6F6788-4009-11D1-8184-00A0C95C0756}
   • \CLSID\{91581CB1-0E7B-11D1-9D93-00A0C95C1762}
   • \CLSID\{921BD9FB-4963-11D1-818D-00A0C95C0756}
   • \CLSID\{94A95A15-EA82-46F5-B5BF-1176F6D77DF7}
   • \CLSID\{94BFEEF1-3EAD-41E2-86FC-E1502DB9CB06}
   • \CLSID\{98694799-6891-4FD7-A91D-FB43B78AEC8C}
   • \CLSID\{9A4A52A6-7B83-403D-A6C9-1C8A492687CD}
   • \CLSID\{A1987DB8-9F0D-47D1-80C9-DFCE76260841}
   • \CLSID\{A302D4CF-8AAD-4B44-ADDE-7D1630CF6C37}
   • \CLSID\{A5C06558-65A3-472D-A950-B5E3324A85C7}
   • \CLSID\{AB08D3A3-260C-4CAB-BC71-8784DF963C8F}
   • \CLSID\{AB124073-6726-461F-B219-BBD3E6DE19E1}
   • \CLSID\{ABBAB8BD-E4F1-11D1-A42C-00A0C9A243C6}
   • \CLSID\{ABBAB8BE-E4F1-11D1-A42C-00A0C9A243C6}
   • \CLSID\{AC0A837D-9BE0-49A4-9495-582AFB88A673}
   • \CLSID\{AE78D5A2-46A3-43BB-A166-1B0018F0F21B}
   • \CLSID\{AEF1A62D-7C44-4985-9388-E9EE70F6CCFE}
   • \CLSID\{AFBBB9C6-8A99-11D1-8892-0080C75FFCC4}
   • \CLSID\{AFBBB9C7-8A99-11D1-8892-0080C75FFCC4}
   • \CLSID\{B1E8CB59-77C3-4A8D-9B0D-73A1F71C71A8}
   • \CLSID\{B91B0CAE-D866-11D1-B78C-00A0C99C7131}
   • \CLSID\{BC66531F-3136-46B0-9FEA-AC2AB3B7CF66}
   • \CLSID\{BE70B0B7-25AF-46E2-AF30-ED4EBBC1F149}
   • \CLSID\{BEE62D80-4A07-11D1-818E-00A0C95C0756}
   • \CLSID\{C05C035C-9C26-4F1E-B8BB-13F847313208}
   • \CLSID\{C0C14422-4924-41B9-971A-030CB1119C3B}
   • \CLSID\{C859248A-513E-11D1-8194-00A0C95C0756}
   • \CLSID\{C859248B-513E-11D1-8194-00A0C95C0756}
   • \CLSID\{C904B403-EA5E-48AB-99B6-F5A6EAD6D908}
   • \CLSID\{CCD1C6CC-DCA5-448E-8C35-3BA8C6FBF99D}
   • \CLSID\{CED1DFB3-4A7D-463F-985C-DBF75C52680B}
   • \CLSID\{D4268CC3-BE07-4B6F-8364-B853D09FF3BD}
   • \CLSID\{D8291AC9-318B-493B-9BF8-9F8727A02675}
   • \CLSID\{DD81F5CE-708A-4260-B4B5-CEF7EDBDC809}
   • \CLSID\{DEB07E48-ABCF-48AA-9B43-97E45D338C50}
   • \CLSID\{DEDC07E8-EE02-4AB9-8DE3-15808156CB49}
   • \CLSID\{E17664B2-DFBE-4654-8E40-672EC40C0276}
   • \CLSID\{E25C22E6-78BD-45F9-88D2-6DF7A580E400}
   • \CLSID\{E381F1C0-910E-11D1-AB1E-00A0C90F8F6F}
   • \CLSID\{E59CB7FB-1C4E-4733-BBBD-29F3D366BAFD}
   • \CLSID\{E7329452-FE39-4129-AB0F-5F8FD0AC628C}
   • \CLSID\{E99BD5E1-FD77-4142-94DC-2BA6057951B3}
   • \CLSID\{EE68EAFC-BF28-4017-8A92-D17DACF0B459}
   • \CLSID\{F20393E2-7481-49A3-8543-0268AA252EA8}
   • \CLSID\{F32F2026-8607-11D1-8892-0080C75FFCC4}
   • \CLSID\{F32F2027-8607-11D1-8892-0080C75FFCC4}
   • \CLSID\{F32F202A-8607-11D1-8892-0080C75FFCC4}
   • \CLSID\{F32F202B-8607-11D1-8892-0080C75FFCC4}
   • \CLSID\{F50BD50D-952E-4C4E-BF0E-C435015C6ADD}
   • \CLSID\{FC894628-B91D-11D1-8254-00A0C95C0756}
   • \CLSID\{FC894629-B91D-11D1-8254-00A0C95C0756}
   • \CLSID\{FD49B8C4-41FE-498D-95A0-BD12BADE43A9}
   • \CLSID\{FF1C1AB8-C27D-11D1-8263-00A0C95C0756}
   • \CLSID\{FF1C1AB9-C27D-11D1-8263-00A0C95C0756}
   • \Drive\shellex\ContextMenuHandlers\LDVPMenu
   • \EXCHNGUI.ExchngUICtrl.1
   • \Folder\ShellEx\ContextMenuHandlers\LDVPMenu
   • \FwsCtrl.BrowserProtection
   • \FwsCtrl.BrowserProtection.1
   • \FwsCtrl.CAutoprotectFw
   • \FwsCtrl.CAutoprotectFw.1
   • \FwsCtrl.CCmcManagement
   • \FwsCtrl.CCmcManagement.1
   • \FwsCtrl.CNACProtection
   • \FwsCtrl.CNACProtection.1
   • \FwsCtrl.FwsProtectionProvider
   • \FwsCtrl.FwsProtectionProvider.1
   • \FwsCtrl.IpsProtection
   • \FwsCtrl.IpsProtection.1
   • \FwsCtrl.NACProtectionProvider
   • \FwsCtrl.NACProtectionProvider.1
   • \FwsCtrl.PEPProtection
   • \FwsCtrl.PEPProtection.1
   • \FwsCtrl.PEPProtectionProvider
   • \FwsCtrl.PEPProtectionProvider.1
   • \HPPProtectionProviderUI.BASHProtection
   • \HPPProtectionProviderUI.BASHProtection.1
   • \HPPProtectionProviderUI.HPPProtectionPr
   • \HPPProtectionProviderUI.HPPProtectionProvider.1
   • \INETMAILUI.InetMailUICtrl.1
   • \Installer\Products\9488817E81CADEA4081E1969AF75C7F9
   • \Installer\Products\EBAABBA7EF02CB74D9BA5062A204D203
   • \Installer\UpgradeCodes\20A7FB42A06BB49448A397B3CB77ED4D
   • \Interface\{002E704B-6E16-40EA-AEBA-E858BCA82B89}
   • \Interface\{11442D72-F6E6-402F-935D-259A138CDE24}
   • \Interface\{11D8A19E-B7BA-46EE-BCB7-4A8A741CAC2F}
   • \Interface\{1297D925-FC7C-4201-A721-EE628C757C1A}
   • \Interface\{26AFF61A-3282-4915-92C6-DCD3DB29BD5C}
   • \Interface\{2843A4DD-917F-4322-B5AA-5A262CAE143D}
   • \Interface\{2E9218D3-0CF5-4502-B308-63AC5EE5D137}
   • \Interface\{3CE447DF-10EC-4852-ACDA-617BFC495716}
   • \Interface\{3DF841FB-5316-48B4-B78A-AA62200897D3}
   • \Interface\{45389BB6-6A0A-41AE-8044-6B0FDDEC87CC}
   • \Interface\{4631BA12-67C1-4A91-9D98-BC74B0E5A716}
   • \Interface\{4D7099CB-24F4-4502-B317-56E0EDD3D378}
   • \Interface\{4DD8D82B-432C-40EF-9788-853452C20168}
   • \Interface\{501F9014-F64A-49AD-A36D-CB8F722D3739}
   • \Interface\{536604C0-B82E-11D1-8252-00A0C95C0756}
   • \Interface\{536604C1-B82E-11D1-8252-00A0C95C0756}
   • \Interface\{587162BB-EB25-423C-BE97-EFE38BB0A2AE}
   • \Interface\{633A25E8-4FFE-4BD5-BCBF-61B31D7FDDF3}
   • \Interface\{646C8A12-4A6B-425C-97F4-C22DDA93B744}
   • \Interface\{667C382E-70C4-45FA-9E01-9EB0B956AB3C}
   • \Interface\{6DEE0551-3EE6-4F3A-B420-48EBABA110CB}
   • \Interface\{7006BA9F-5D2C-4344-A3C9-9F82ADDF1A73}
   • \Interface\{888B91C3-9CC9-42E2-A085-0633B463FC13}
   • \Interface\{979920CF-81B8-4C1A-988F-15355AE8AD64}
   • \Interface\{A2B69D18-A0A3-45EC-8517-053075BD4D90}
   • \Interface\{A9CC9305-0A30-4015-92A0-0711EE24E720}
   • \Interface\{B473C0DD-AF12-4C13-9036-25D2BDCA2859}
   • \Interface\{B53FDB2B-BEBC-4502-BED2-26479677146C}
   • \Interface\{C05C035C-9C26-4F1E-B8BB-13F847313208}
   • \Interface\{C181575D-C0D6-4E1F-B517-0E2C3C312E4B}
   • \Interface\{CB4EB90C-FDA1-485A-ACB2-50D4804EA169}
   • \Interface\{CD653B9D-F5A3-4F91-A3BE-16B209E29339}
   • \Interface\{D0FE7F2E-0090-4237-9EA9-C432D661FF0A}
   • \Interface\{D57906B2-AA5D-4CFC-8728-296D0186776E}
   • \Interface\{D5B84A4F-1EB8-4C86-B6F9-3DA46B59891B}
   • \Interface\{D76F0CF0-AB6C-4604-8B1B-5CC305D5C289}
   • \Interface\{D7BD6E18-9468-42F5-9CAE-19B3164F635F}
   • \Interface\{D8ACF3FA-B1FD-ADB4-8660-6CAEF999B999}
   • \Interface\{D8FCD44A-B1FD-ABB4-8660-9C0EF889B752}
   • \Interface\{E4866660-DB82-4233-99A2-03F25C895214}
   • \Interface\{E7329452-FE39-4129-AB0F-5F8FD0AC628C}
   • \Interface\{EAA6B14E-CA51-4DAB-8049-96B243BD7F6E}
   • \Interface\{F0576720-A999-4A71-8ADE-61C621ED8407}
   • \Interface\{F672352D-267F-4E95-BD6F-9EB0D5791963}
   • \Interface\{FC2D4656-887F-474B-9A49-4FCEFD470DB4}
   • \Interface\{FED18B74-E38E-4738-B882-0FF8D74ABEB3}
   • \LDDATETIME.LDDateCtrl.1
   • \LDDATETIME.LDStaticDateTimeCtrl.1
   • \LDDATETIME.LDTimeCtrl.1
   • \LDVPCTLS.LDVPActionsCtrl.1
   • \LDVPCTLS.LDVPEditCtrl.1
   • \LDVPCTLS.LDVPExtensionsCtrl.1
   • \LDVPCTLS.LDVPResultsCtrl.1
   • \LDVPCTLS.LDVPVirusDetailsCtrl.1
   • \LDVPDLGS.LDVPAboutDlgCtrl.1
   • \LDVPDLGS.LDVPCompressedCtrl.1
   • \LDVPDLGS.LDVPEmailNotifySettingsCtrl.1
   • \LDVPDLGS.LDVPMessageConfigCtrl.1
   • \LDVPDLGS.LDVPSchedule2Ctrl.1
   • \LDVPDLGS.LDVPSchedule3Ctrl.1
   • \LDVPDLGS.LDVPScheduleCtrl.1
   • \LDVPDLGS.LDVPStorageViewCtrl.1
   • \LDVPDLGS.LDVPThreatExclusionsDlgCtl.1
   • \LDVPUI.LDVPUICtrl.1
   • \PatchWrap.PatchWrapper
   • \PatchWrap.PatchWrapper.1
   • \ProtectionUtil.ProtectionCollection
   • \ProtectionUtil.ProtectionCollection.1
   • \ProtectionUtil.ProtectionProviderColl.1
   • \ProtectionUtil.ProtectionProviderCollec
   • \ProtectionUtil.Protection_GUID_Contai.1
   • \ProtectionUtil.Protection_GUID_Containe
   • \ProtectionUtil.StatusFinder
   • \ProtectionUtil.StatusFinder.1
   • \ProtectionUtil.StatusProblem_Autoprot.1
   • \ProtectionUtil.StatusProblem_Autoprotec
   • \ProtectionUtil.StatusProblem_BashError
   • \ProtectionUtil.StatusProblem_BashError.1
   • \ProtectionUtil.StatusProblem_Containe.1
   • \ProtectionUtil.StatusProblem_Container
   • \ProtectionUtil.StatusProblem_DAError
   • \ProtectionUtil.StatusProblem_DAError.1
   • \ProtectionUtil.StatusProblem_DAOff
   • \ProtectionUtil.StatusProblem_DAOff.1
   • \ProtectionUtil.StatusProblem_Definiti.1
   • \ProtectionUtil.StatusProblem_Definition
   • \ProtectionUtil.StatusProblem_DefsCorr.1
   • \ProtectionUtil.StatusProblem_DefsCorrup
   • \ProtectionUtil.StatusProblem_HostInte.1
   • \ProtectionUtil.StatusProblem_HostIntegr
   • \ProtectionUtil.StatusProblem_NetworkA.1
   • \ProtectionUtil.StatusProblem_NetworkAcc
   • \ProtectionUtil.StatusProblem_NetworkQ.1
   • \ProtectionUtil.StatusProblem_NetworkQua
   • \ProtectionUtil.StatusProblem_Provider.1
   • \ProtectionUtil.StatusProblem_ProviderAu
   • \ProtectionUtil.StatusProblem_ProviderEr
   • \ProtectionUtil.StatusProblem_ProviderOf
   • \ProtectionUtil.StatusProblem_RebootPending
   • \ProtectionUtil.StatusProblem_RebootPending.1
   • \ProtectionUtil.StatusProblem_Trialwar.1
   • \ProtectionUtil.StatusProblem_TrialwareE
   • \Rtvscan.CSavInfo
   • \Rtvscan.CSavInfo.1
   • \Rtvscan.CSavQuarantine
   • \Rtvscan.CSavQuarantine.1
   • \Rtvscan.MailScanEngine
   • \Rtvscan.MailScanEngine.1
   • \Rtvscan.ResultsViewCOMCallback
   • \Rtvscan.ResultsViewCOMCallback.1
   • \Rtvscan.ScanManagerService
   • \Rtvscan.ScanManagerService.1
   • \Rtvscan.VirusFoundCOMCallback
   • \Rtvscan.VirusFoundCOMCallback.1
   • \SavMainUI.ConfigureableScanCollection
   • \SavMainUI.ConfigureableScanCollection.1
   • \SavMainUI.SavAutoprotectExchange
   • \SavMainUI.SavAutoprotectExchange.1
   • \SavMainUI.SavAutoprotectFilesystem
   • \SavMainUI.SavAutoprotectFilesystem.1
   • \SavMainUI.SavAutoprotectInternetEmail
   • \SavMainUI.SavAutoprotectInternetEmail.1
   • \SavMainUI.SavAutoprotectNotes
   • \SavMainUI.SavAutoprotectNotes.1
   • \SavMainUI.SavConfigureableScan
   • \SavMainUI.SavConfigureableScan.1
   • \SavMainUI.SavProtectionProvider
   • \SavMainUI.SavProtectionProvider.1
   • \SavMainUI.SavQuarantineItem
   • \SavMainUI.SavQuarantineItem.1
   • \SavMainUI.SavQuarantineItemCollection
   • \SavMainUI.SavQuarantineItemCollection.1
   • \SavMainUI.TamperProtectionProvider
   • \SavMainUI.TamperProtectionProvider.1
   • \SavMainUI.TamperProtectProcess
   • \SavMainUI.TamperProtectProcess.1
   • \SavUI.ActionableAlertCOMAdapter
   • \SavUI.ActionableAlertCOMAdapter.1
   • \SavUI.ResultsViewCOMAdapter
   • \SavUI.ResultsViewCOMAdapter.1
   • \SavUI.VirusFoundCOMAdapter
   • \SavUI.VirusFoundCOMAdapter.1
   • \SEP.AV.ScanDlgs
   • \SEPOutlookAddin.OutlookAddin
   • \SEPOutlookAddin.OutlookAddin.1
   • \Shelsel2.Shelsel2
   • \Shelsel2.Shelsel2.1
   • \Symantec.IPS.WebProtection.1
   • \SymNAPSHAgent.CSymNAPSHAgentComponentInfo
   • \TypeLib\{1C68BD0A-0264-4D90-904E-69D63F9090FC}
   • \TypeLib\{2149B26D-55C9-4DC3-BD03-B982AAA1733A}
   • \TypeLib\{2707AAC2-C268-11D1-8263-00A0C95C0756}
   • \TypeLib\{2E76B2B4-C603-11D1-826C-00A0C95C0756}
   • \TypeLib\{536604BF-B82E-11D1-8252-00A0C95C0756}
   • \TypeLib\{592DC449-4977-11D1-818D-00A0C95C0756}
   • \TypeLib\{69A9E691-DD09-4DBD-BBE1-BB63B8BE2652}
   • \TypeLib\{6F952B50-BCEE-11D1-82D6-00A0C9749EEF}
   • \TypeLib\{7F1806A6-1864-4697-A06B-E36F41D75DEF}
   • \TypeLib\{9D75182B-19F7-469B-83CB-180FE3338F33}
   • \TypeLib\{A559E5DA-F585-4590-AAC4-E00737E19425}
   • \TypeLib\{C0155A1A-11F1-4178-BE82-32FA1BB6AA5D}
   • \TypeLib\{E8996CAF-8E36-4818-948E-5C627388056F}
   • \TypeLib\{F32F2023-8607-11D1-8892-0080C75FFCC4}
   • \TypeLib\{FAD5CC54-0E68-11D1-9D91-00A0C95C1762}
   • \TypeLib\{FF1C1AB5-C27D-11D1-8263-00A0C95C0756}
   • \VpshellEx.VpshellEx
   • \VpshellEx.VpshellEx.1
9. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Classes, and delete the keys listed in step 8.
10. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node, and delete the keys listed in step 8.
11. Go to HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432node\Classes, and delete the keys listed in step 8.
12. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, and click theUninstallregistry key to select it.
13. On the Edit menu, clickFind.
14. Typesymantecand clickFind Next.
15. Look for any values that appear in the right pane that includes the word Symantec, in a key that is still in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall.
16. If the key that is selected is still in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, delete the key (in the left pane) – it will be a 24 alphanumeric “GUID” surrounded by {} brackets.
    Repeat the search.
17. If the key that is selected is not in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, continue to the next step.
18. Remove any values with "Symantec" in the path from the following key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls
19. ClickEdit>Findand search for any instances of the following strings, deleting any registry values that contain them or have the string as the name:
    • Vpshell2
    • VpShellEx
    • VpshellRes

Find and remove the product GUID

1. In the Windows Registry Editor, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\
2. ClickProducts.
3. ClickEdit>Find.
4. TypeSymantec Endpoint Protection.
5. ClickFind Next.
6. A value appears in the right pane that includes the words Symantec Endpoint Protection, in a key named "InstallProperties". The "InstallProperties" key resides within another key whose name is a hexadecimal string. This hexadecimal string is the product GUID.
7. ClickEdit>Findand search for any instances of the product GUID, and delete any registry values that contain it or have the string as the name.

Restore default Windows network settings

1. In the Windows Registry Editor, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetworkProvider\HwOrder.
2. Edit the ProviderOrder value and remove "SnacNp" from the list.
3. Repeat step 2 for HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetworkProvider\Order.
4. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP.
5. In the "13" key, delete the following values:
   • ConfigUIPath
   • IdentityPath
   • InteractiveUIPath
   • Path
6. Rename the following keys:
   • ConfigUIPathBackup to ConfigUIPath
   • IdentityPathBackup to IdentityPath
   • InteractiveUIPathBackup to InteractiveUIPath
   • PathBackup to Path.
7. Repeat steps 5 and 6 for the "25", "26", and "4" keys.
8. Delete the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\88.

Remove Endpoint Protection files and folders

1. Restart the computer insafe mode.
2. Log on as Administrator.
3. Delete the following files and folders. If a file or folder is not present, proceed to the next one.
   • C:\Program Files (x86)\Symantec\Symantec Endpoint Protection
     If you installed Symantec Endpoint Protection in a different folder, delete that folder instead.
   • C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Symantec Endpoint Protection
   • C:\Users\All Users\Symantec
   • C:\ProgramData\Symantec
   • C:\Windows\System32\drivers\SEP
4. Go to %systemdrive%\System Volume Information.
5. Right-clickEfaData, clickProperties, and uncheckRead-only.
6. DeleteEfaData.
7. Delete the following driver files in both C:\Windows\System32\drivers and C:\Windows\SysWOW64\drivers. In all cases delete the files with the extensions .sys, .cat, and .inf with the following prefixes:
   • SEP
   • Symevent
   • SysPlant
   • Teefer
   • WGX
8. Delete the following driver files in both C:\Windows\System32 and C:\Windows\SysWOW64:
   • FwsVpn.dll
   • SysFer.dll
   • snacnp.dll
   • SysFerThunk.dll
   • SymVPN.dll
9. Go to C:\Windows\Installer\.
10. For each file in C:\Windows\Installer, right-click the file and clickProperties.
11. On the Summary tab, check to see if Symantec created the file. If it was, delete the file.
12. Repeat steps 10 and 11 for every file in the folder.

Remove the Teefer driver

1. ClickStart>Search, type cmd, and pressCtrl+Shift+Enterto start a command prompt with Administrator privileges.
2. Typepnputil -eto list the Symantec drivers in the driver store.
3. Typepnputil -f -d oem<n>.infto remove Symantec drivers from driver store, where<n>is a number corresponding to one of the Symantec drivers listed in the previous step.
4. Typeexitto close the command prompt.
5. In the Windows Registry Editor, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}.
6. Delete any keys that have a value of "ComponentId" that is set to "symc_teefer2".
7. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{ad498944-762f-11d0-8dcb-00c04fc3358c}.
8. Delete any keys that have a name containing SYMC_TEEFERMP.
9. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{cac88424-7515-4c03-82e6-71a87abac361}.
10. Delete any keys that have a name containing SYMC_TEEFERMP.
11. Close the Windows Registry Editor.
12. In Device Manager (devmgmt.msc), go to Network Adapters, and delete all entries with "teefer" in them.
13. Delete any network adapters to which teefer was attached.
    The adapters will reinstall. This step must be done in order for there to be network connectivity after you restart the computer.
14. Restart the computer in normal mode.

Restart the computer

The computer must be restarted to ensure that all changes have been made.