Spyware, viruses, & security forum: Symantec Endpoint Protection 11 Removal Tool

I have Windows Vista Basic Home edition (32-bit).

Thanks Carol! I will give it a try. I'm just scared because there are so many steps and I don't want to mess up my computer in case I screw up on a step. Ridiculous how Symantec does not have a removal tool...

In an effort to try to find the efficacy of the tool and it's use with Vista, I (only) read through 9 pages of a 26 page thread. Some things I'd like to point out.

Read the bottom of page 3 of the thread, where Vista is discussed. Keep in mind the date of the post. Things may have changed since then.

The only post I find marked with an "accepted solution", by a Symantec employee, reads as follows:

The Cleanwipe utility is a very easy but potentially very dangerous tool to use which is why Symantec is requiring customers to open a call to receive the utility. The *best* way to remove the product has always been, and always will be, to use the Add/Remove programs feature in the control panel. If Cleanwipe would be available for anyone to download wed have people running cleanwipe to fix things that dont require uninstalls in the first place, because its relatively easy to use.

A Symantec technician should be the one to deem it necessary to run.

Helen Gressman
SEP Forum Moderator

According to what I read in the thread, the general consensus seems to be that it's best to email them. Otherwise, you might be hanging on the phone "endlessly". Some even found themselves speaking with someone, as far away as India! Imagine that!
https://mysupport.symantec.com

Endpoint Protection
Contact Technical Support

If it were me, I would contact them at the above address and ask if the tool can be used with Vista and also if it will remove your specific version. Whichever route you decide to take, I wish you the best of luck..

Carol

I first attempted to get rid of this program by following the manual instructions that symantec gave:

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007080209280848

After completing all the steps, I noticed that some items were not removed, such as a broken live update icon in the control panel that i could not remove and a broken symantec icon in the control panel which did not have the option of uninstall/change. Because of this, I decided to give cleanwipe a try. After doing this and restarting, something was obviously wrong with my computer. Everytime I started up, a message would pop up saying "Windows Host Services has stopped working."

I decided to do a system restore to before i tried to get rid of symantec, but this did not work. Symantec was already "killed" and would not run anymore, but was still present on my computer. Also, my internet adapters started to fail me and would not connect via wireless or cable (I am on my other computer). I tried to uninstall symantec again via the add/uninstall programs function, but the installer would not work properly and kept getting stuck at the last step. To solve this, I tried to download Symantec Endpoint Protection again and reinstall it. Also did not work, as the installer got stuck on the last step. Crossing my fingers, I decided to run cleanwipe one more time, but same thing happened as before. Except this time, I have no internet.

AHh what should I do? Very worried right now.

Oh, I feel your pain. Symantec really did not make it easy this time around.
Looking at the provided instructions, there are couple of additional registry entries that need to be removed, if still present after the uninstall:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13]
"FriendlyName"="Smart Card or other certificate"
"Path"="C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\SymRasMan64.dll"
"ConfigUiPath"="C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\SymRasMan64.dll"
"IdentityPath"="C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\SymRasMan64.dll"
"InteractiveUIPath"="C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\SymRasMan64.dll"
"InvokeUsernameDialog"=dword: "InvokePasswordDialog"=dword: "MPPEEncryptionSupported"=dword: 1 "ConfigCLSID"="{58AB2366-D597-11d1-B90E-00C04FC9B263}" "StandaloneSupported"=dword: "NoRootRevocationCheck"=dword: 1 "RolesSupported"=dword: 3 "PerPolicyConfig"=dword: 1 Code: Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\25]
"FriendlyName"="Protected EAP (PEAP)"
"Path"="C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\SymRasMan64.dll"
"ConfigUiPath"="C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\SymRasMan64.dll"
"IdentityPath"="C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\SymRasMan64.dll"
"InteractiveUIPath"="C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\SymRasMan64.dll"
"InvokeUsernameDialog"=dword: "InvokePasswordDialog"=dword: "MPPEEncryptionSupported"=dword: 1 "ConfigCLSID"="{58AB2366-D597-11d1-B90E-00C04FC9B263}" "StandaloneSupported"=dword: 1 "NoRootRevocationCheck"=dword: 1 "RolesSupported"=dword: 13 "PerPolicyConfig"=dword: 1

See if this does the trick.

I would not recommend touching SEP11. Stick with your current anti-virus software, if you like it. Or you can try anti-virus from TrendMicro (http://trendmicro.com). For endpoint security you can try zlock from zecurion.

good luck and let me know how you made out.

sal