Removing Symantec Mail Security for Microsoft Exchange manually if Add or Remove Programs does not work

book

Article ID: 159174

calendar_today

Updated On:

Products

Mail Security for Microsoft Exchange

Issue/Introduction

 Instructions to manually remove the components of Symantec Mail Security for Microsoft Exchange if Add or Remove programs does not work.

Resolution

 WARNING: In the next steps you will edit the Windows registry. Back up the registry before you make any changes to it, because incorrect changes to the registry can result in permanent data loss or corrupted files. Modify only the registry keys that are specified. 


The following document explains how to back up the registry: How to back up, edit, and restore the registry in Windows 7 and Windows Server 2008

 

1.  Stop Services.

Open a command prompt and enter the following commands:

net stop smsmse

net stop SAVFMSESpamStatsManager

net stop "Symantec Mail Security Management Service"

net stop SMSUM

sc delete smsmse

sc delete SAVFMSESpamStatsManager

sc delete "Symantec Mail Security Management Service"

sc delete SMSUM

 2. Unregister SMSMSE from LiveUpdate:

Open a command prompt on the computer where SMSMSE is installed and run the following command:

regsvr32.exe /u "<InstallDir>\SMSMSE\<version>\Server\SAVFMSELU.dll"

NOTE: Change the value of <version> to the appropriate version of SMSMSE installed.  The following is an example for SMSMSE 7.5 on a 64-bit OS:

regsvr32.exe /u ""<InstallDir>\SMSMSE\7.5\Server\SAVFMSELU.dll"

3. Remove Symantec Mail Security for Microsoft Exchange Web site in Internet Services Manager.

  1. Open Start > Administrative Tools >Computer Management.
  2. Navigate to Services and Applications > Internet Information Services
  3. On the right hand side menu expand Server Name > Sites.
  4. Right click Symantec Mail Security for Microsoft Exchange and select Remove.
  5. On the right hand side menu expand Server Name > Application Pools.
  6. Right click on SMSMSEAppPool and select Remove.
  7. Open a command prompt and enter the following commands:

iisreset

4. Remove registry keys.

a. Exit all programs.
b. Open regedit and remove the following folders if they are present:

HKEY_CLASSES_ROOT\Installer\Products\73EA6C0FDBA5AFA4CA1C0C5B876273E2

HKEY_CLASSES_ROOT\Installer\Products\0B274DA10D92087468CF3D24B3B6ED40

HKEY_CLASSES_ROOT\Installer\Products\D4AA5D97EBD63394CAD63D508C85DC46

HKEY_CLASSES_ROOT\Installer\Products\F5DC00EDF4103A84CA58C06124B16E77

HKEY_CLASSES_ROOT\Installer\Products\42CA1F7EA2FA57B4D914D9D7F0260883

HKEY_CLASSES_ROOT\Installer\Products\F9DA16A962F31E84E9300712578CC7B9

HKEY_CLASSES_ROOT\Installer\Products\73EA6C0FDBA5AFA4CA1C0C5B876273E2
HKEY_CLASSES_ROOT\Installer\Products\1E8755C89CC80904F81A5FDAE31B72B1

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\73EA6C0FDBA5AFA4CA1C0C5B876273E2

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\0B274DA10D92087468CF3D24B3B6ED40

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\D4AA5D97EBD63394CAD63D508C85DC46

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\F5DC00EDF4103A84CA58C06124B16E77

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\42CA1F7EA2FA57B4D914D9D7F0260883

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\F9DA16A962F31E84E9300712578CC7B9 

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\73EA6C0FDBA5AFA4CA1C0C5B876273E2
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\1E8755C89CC80904F81A5FDAE31B72B1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C6AE37-5ABD-4AFA-ACC1-C0B57826372E}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79D5AA4D-6DBE-4933-AC6D-D305C858CD64}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AD472B0-29D0-4780-86FC-D3423B6BDE04}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E7F1AC24-AF2A-4B75-9D41-9D7D0F628038}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9A61AD9F-3F26-48E1-9E03-702175C87C9B} 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0C6AE37-5ABD-4AFA-ACC1-C0B57826372E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8C5578E1-8CC9-4090-8FA1-F5AD3EB1271B}

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Cmaf

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\Cmaf

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SMSMSE

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\InstalledApps\SMSMSE7.5

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\InstalledApps\SMSVersionSupport

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\InstalledApps\SymcData-virusdefs32

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\SharedDefs\SymcData-virusdefs32

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\SMSMSE

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\SMSMSESPC

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\SMSMSEPERF

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\Symantec Mail Security for Microsoft Exchange

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\Symantec Mail Security Managed Components

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Symantec Mail Security Management Service

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\VirusScan

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SAVFMSESpamStatsManager

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SMSMSE

HKEY_LOCAL_MACHINE\System\CurrentControlSet001\Services\SMSUM
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SAVFMSEPSCommandExecuter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SAVFMSEPSCommandExecuter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SAVFMSEPSCommandExecuter

Note: You should also verify the enumerated control set entries for SMSMSE services.  e.g. CurrentControlSet001, CurrentControlSet002..

 5. Remove Exchange Transport Agents (if on a HUB server).

a. Open the Exchange Management Shell and enter the following commands:

Uninstall-Transportagent -identity "SMSMSESMTPAgent"

Uninstall-TransportAgent -identity "SMSMSERoutingAgent"
Restart-Service MSExchangeTransport

6. Remove file system folders.

            C:\ProgramData\Symantec\Definitions\SymcData\virusdefs32 (Windows 2008 only)
            C:\Program Files (x86)\Common Files\Symantec Shared\definitions
            C:\Program Files (x86)\Common Files\Symantec Shared\SymcData\virusdefs32 (Windows 2003 only)
            C:\Program Files (x86)\Symantec\SMSMSE

            c:\Program Files (x86)\Symantec\CMaF


            NOTE: These paths are the default locations; adjust the paths if you installed the program into a different location.    
            

7. Delete Administration Console icon from desktop.

Remove Rights from domain user account on Exchange 2010/2013/2016


When you install SMSMSE 7.5 on Microsoft Exchange Server 2010/2013/2016, the service account specified during installation is granted ApplicationImpersonation and LogonAsService rights. These rights are not removed when you uninstall SMSMSE 7.5. Removing these rights is optional but recommended if you do not plan to run SMSMSE in your network with this user account.

WARNING: Do not remove the rights given to this user if the same user is being used on other Exchange servers in the same domain.


1. Click Start > All Programs >Microsoft Exchange Server 2010 > Exchange Management Shell. It may take a few moments for a prompt to appear.
2. At the prompt, type the following, and then press Enter:

remove-ManagementRoleAssignment SMSMSE_RBAC_<domain\username>


where <domain\username> is the correct domain and user name.


3. Press Y at the confirmation prompt and then press Enter.
4. Click Start > Administrative Tools > Local Security Policy
5. In the left pane, expand Local Policies and click User Rights Assignment.
6. In the right pane, double-click Log on as a service.
7. On the Local Security Setting tab, click the correct user name.
8. Click the Remove button.
9. Click OK.

8. Remove transport agent entries

Open agents.config which can be found under "<Drive>:\Program Files\Microsoft\Exchange Server\<version>\TransportRoles\Shared" and remove the following two lines:

<agent name="SMSMSERoutingAgent" baseType="Microsoft.Exchange.Data.Transport.Routing.RoutingAgent" classFactory="Symantec.MailSecurity.Server.TransportAgent.SMSMSERoutingAgentFactory" assemblyPath="<drive>\Program Files (x86)\Symantec\SMSMSE\<version>\Server\Symantec.MailSecurity.Server.TransportAgent.dll" enabled="true" />
<agent name="SMSMSESMTPAgent" baseType="Microsoft.Exchange.Data.Transport.Smtp.SmtpReceiveAgent" classFactory="Symantec.MailSecurity.Server.TransportAgent.SMSMSESMTPAgentFactory" assemblyPath="<drive>\Program Files (x86)\Symantec\SMSMSE\<version>\Server\Symantec.MailSecurity.Server.TransportAgent.dll" enabled="true" />

 

You can get the removal script to automate the removal process at https://support.symantec.com/en_US/article.TECH214662.html