McAfee Agent

McAfee Agent

McAfee Agent is a component of the McAfee ePO that automatically enforces policies and performs other tasks such as updating and deployment. Another function of the McAfee Agent is to upload events and provide data about the system’s status.

If you are using McAfee ePO (Mcafee ePolicy Orchestrator), you need to have the McAfee Agent installed on all systems that are part of the network you are managing. Then the Agent will automatically provide you with data regarding the status of your endpoints and will help you with enforcing endpoint policies. If you don’t have the McAfee Agent installed on a given endpoint, McAfee ePO won’t be able to manage that endpoint device.

One thing that needs to be said about the McAfee Agent is that it is definitely not a virus program. There are many concerned users on the Internet who have noticed the presence of this software on their computers and are wondering whether a malicious program that has disguised itself as a McAfee product has secretly infiltrated the computer. The main reason for this concern is the fact that the McAfee Agent could get automatically installed on endpoint computers without the user’s interaction. 

If you are a user who has this software piece on their computer and think that it may be a virus, know that your system is likely safe. If the computer is a part of a certain network managed by an ePO server, then it would make sense for it to have the McAfee Agent. On the other hand, if for some reason you have this software on your personal computer and you don’t think it’s supposed to be there, then removing it is always an option and the process of doing so shouldn’t prove to be too difficult. Detailed removal instructions for McAfee Agent can be found below.

McAfee Agent Handler

The McAfee Agent Handler is a piece of software that facilitates your control over the network’s endpoints by routing the communication between McAfee Agents and the ePO server. The McAfee Agent Handler helps with managing big numbers of endpoints from a single ePO server.

The way the McAfee Agent Handler works is by distributing the network traffic of your endpoints by creating groups of systems that would communicate with a given Agent Handler. This decreases the workload that your ePO server needs to handle since the Agents would be communicating with the Agent Handler rather than directly with the server.

If you are in need of handling a large number of products but are limited by the capabilities of your server(es), then using McAfee Agent Handlers could make the network more efficient and easier to manage.

How to uninstall McAfee Agent?

To uninstall McAfee Agent, you can try running the FrmInst.exe program that will automatically delete everything related to the agent. If this doesn’t work, you can also uninstall McAfee Agent manually, by deleting its Registry entries – this method is significantly more difficult and time-consuming.

Below, we will explain to you how each of the two removal methods can be completed. We suggest trying the automatic one first as it’s safer and requires much less time. If for some reason it fails, you can always try the manual removal steps, but note that since they involve making changes in the System Registry, they need to be performed with great care so as to avoid accidentally damaging the computer’s system by deleting or changing something you aren’t supposed to. If you attempt to perform the manual removal method and aren’t certain about something, do not hesitate to contact our team through the comments below this post, telling us about the obstacle you are facing.

Lastly, before we give you the removal steps, note that you may need to disable the McAfee services protection if you have VSE (VirusScan Enterprise) – this is only required if you have VSE installed on your computer. If you have it, here’s how to disable its protection for McAfee products:

How to disable McAfee services protection in VSE if VSE is managed with ePO

1. On the computer from which you want to uninstall McAfee Agent, open the Start Menu, and go to Programs.
2. Find and select McAfee and then click the VirusScan Console.
3. Right-click on the Access Protection option and then go to Properties.
4. Uncheck the Prevent McAfee services from being stopped option and select Apply.
5. Close the window of the VirusScan Console.

How to disable McAfee services protection in VSE if VSE is not managed with ePO

1. On the McAfee ePO server, go to the ePolicy Orchestrator Console and find and select the computer level or directory where you wish to change the VSE settings/policy.
2. Expand the VirusScan Enterprise policy in the right panel.
3. Select the Edit option that’s next to the Access Protection Policies.
4. Go to the Access Protection tab, uncheck the Prevent McAfee services from being stopped option, and select Apply.
5. Either wait for the next policy enforcement or manually send an agent wake-up call to the endpoint to apply the VSE policy changes.
6. Close the console on the ePO Orchestrator Console.

Remove McAfee Agent using the FrmInst.exe program

1. On the computer from which you want to uninstall the Agent software, click the Start Menu, type Run, and press Enter.
2. Copy-paste either of the next two commands in the Run window and press Enter again (note that the path for the McAfee Agent may vary depending on whether it was installed as a clear installation or as an update – adjust the path in Run command accordingly):
   • “c:\Program Files\McAfee\Agent\x86\frminst.exe” /forceuninstall
   • “c:\Program Files\McAfee\Common Framework\x86\frminst.exe” /forceuninstall
     
3. Once the command is executed, restart your PC.

Once the computer restarts, the McAfee Agent should be gone from it. If for some reason the uninstallation has failed and there are still remnants of the program on your computer, you can proceed to the manual steps to make sure that everything from McAfee Agent is removed.

Manually remove McAfee Agent by editing the System Registry

Note: If your computer is part of a network managed by an ePO server, you may be prohibited from making alterations to the Registry of the computer. If this turns out to be the case, you will need to contact the network Administrator for further assistance.

Important!: As was already mentioned above, editing the Registry and deleting items from it must be done with extreme caution because deleting anything that shouldn’t be removed could result in all kinds of unpredictable and unforeseen consequences. It’s strongly advisable to contact our team through the comments section below in case of doubt about any of the next steps.

1. Type regedit.exe in the Start Menu, press Enter, and click OK to give your Admin permission to the Registry Editor program to make system changes.
   
2. Find the following key in the left panel of the Registry Editor:
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\McAfeeFramework
     
3. Double-click on the Start Value in the right panel, set its Value data to 4, press OK, and restart the computer.
4. When the PC restarts, open the Task Manager by pressing together the Ctrl + Shift + Esc keys from your keyboard.
5. Go to Processes and find and quit all McAfee processes. Here is the full list of processes that you must quit – if any of them isn’t present in the Task Manager, move on to the next one:
   • masvc.exe
   • macmnsvc.exe
   • macompatsvc.exe
   • mctray.exe
   • naPrdMgr.exe
   • UpdaterUI.exe
     
6. Close the Task Manager window and open the Registry Editor (regedit.exe) again.
7. Find the key shown below in the left panel of the Editor and expand it:
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
8. Right-click on the subkey labelled McAfeeFramework, select Delete, and confirm the deletion.
9. Navigate to the next three Registry keys and delete from them the McAfeeFramework subkey if it’s present there:
   • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services
   • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services
   • HKEY_LOCAL_MACHINE\SYSTEM\ControlSetXXX\Services
10. Go to either of the following two Registry keys depending on the architecture of your system:
    • For 32-bit systems: HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\Framework
    • For 64-bit systems: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Network Associates\TVD\Shared Components\Framework
11. See what the values of Installed Path and Data Path are and find and delete the two folders that are mentioned in those Registry values
12. Find and expand either of the next keys (depending on system architecture)
    • KEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components
    • 64-bit:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Network Associates\TVD\Shared Components
13. Delete the subkey labelled Framework.
14. Go to either of the following two keys:
    • 32-bit: HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\McTray
    • 64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\McAfee\McTray
15. Delete the McTray subkey.
16. Find and expand either of the next keys:
    • 32-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
    • 64-bit: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\
17. Depending on your McAfee Agent version, delete the corresponding subkey as shown below:
    • McAfee version 5.6.0 –  Build 5.6.0.702 – Key {4952B7F2-402E-4E99-948C-66BF2C95B769}
    • McAfee version 5.5.0 – Build 5.5.0.447 – Key{386A9C46-C31F-42E8-AC39-583A3174945A}
    • McAfee version 5.0.6 – Build 5.0.6.220 – Key {80684F9A-6B01-4F3F-A8C7-C4B7BDF072F1}
    • McAfee version 5.0.5 – Build 5.0.5.658 – Key {265FA622-A254-49fb-B380-D9EF9ABFD32D}
    • McAfee version 5.0.4 – Build 5.0.4.283 – Key {2B4B02CD-CA9E-4024-9B9B-2EA9950EEC11}
    • McAfee version 5.0.3 – Build 5.0.3.272 – Key {7BB6907F-96E6-4722-AD9B-60C132AEE765}
    • McAfee version 5.0.2 – Build 5.0.2.132 – Key {DEA2D287-B3F7-4828-8332-3CF31ED15ED7}
    • McAfee version 5.0.1 – Build 5.0.1.516 – Key {86D55FFD-408E-4F73-8557-157E920A6AC6}
    • McAfee version 5.0.0 – Build 5.0.0.2620 – Key {8959B1FD-DB2B-438D-93EE-1BAAC7145F69} 
    • McAfee version 4.8 Update – Build 34.8.0.1938 – Key {76473CBB-FE8D-4E3A-9591-CD6EFB621063}
    • McAfee version 4.8 Update – Build 24.8.0.1500 – Key {EBF3D65F-011E-44D2-8F4F-C74B52682EDD}
    • McAfee version 4.8 Update – Build 14.8.0.887 – Key {1FDB8EC6-BAF1-42F9-8E09-4D9AB369F1B5}
    • McAfee version 4.8 – Build 4.8.0.641 – Key {11FEE8E5-D9BD-4AC1-8074-5169069DF812}
18. Navigate to the next Registry key:
    •  [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products]
19. Search the alphanumeric codes list in the Product key and look at the ProductName String value in the right panel to locate the McAfee Agent key.
20. Delete the appropriate McAfee Agent key.
21. Close everything and restart your PC.