Error loading Netshield 4.5 on Winnt 4.0

[sookie]

Event Viewer stats:

Event ID: 5004
Source: MCLogEvent
Description:

Could not contact Filter Driver - NaiFiltr.sys.
Error = The NaiFiltr device is not installed.

SP1 for Netshield 4.5 has been installed on a WINNT 4.0 SP6
server running Backup Exec 8.5 with the latest build.

Can someone please point me in the right direction.

Thanks.

Sookie

 

[Gremy]

According to one of the contributors (T.F.): "This error can occur if you are trying to upgrade from NetShield 4.0.3 to VShield 4.5.0 on a Windows 2000 Pro workstation. The reason for this is that Windows 2000 is not a supported platform for NetShield 4.0.3. Even though it will install and work properly, when you uninstall it and install VShield 4.5.0 or 4.5.1, the McShield service will be unable to start. You can even go as far as uninstalling, then remove all left over files, directories and registry entries and it will still fail. I have spent hours working with Network Associates on this problem and their stance is they have no fix for this. Contact Microsoft or reload OS."
S: This has occurred on other operating systems as well.

 

[sookie]

Thanks, Gremy
Sookie

 

[FatesWebb]

FIRST If it is present on the machine, the solution is to either uninstall it or upgrade it to the latest version of C-Dilla software.

if no cdilla exists

Open Regedt32.exe, open: HKEY_LOCAL_MACHINE, SYSTEM\CurrentControlSet\Services\NAIFiltr.
Find the Data Statement that says ImagePath:REG_EXPAND_SZ:
That statement should direct to the Naifiltr.sys file.
The following example would be for a default install:
ImagePath:REG_EXPAND_SZ:\??\C:\Program Files\Network Associates\NetShield NT\Naifiltr.sys
If not a default install, then search for the NAIFILTR.SYS using the find command, then insert the appropriate path.


IF THIS DOESNT WORK

Use add/remove programs to uninstall NetShield 4.5.
Download the Microsoft Cleanup Utility from

http://support.microsoft.com/support/kb/articles/Q238/4/13.asp.

Install the Cleanup Utility.
Go to Start | Run and browse to C:\Program Files\Windows Cleanup Utility (the default directory) or the directory to which you installed the utility.
At the end of the path statement in the Run box, type a space and then the following: T {DBDCAA19-597C-11D3-89BB-006008C7D0F2}

NOTE: Your Run line should end up looking similar to this, including the quotes:
"C:\Program Files\Windows Cleanup Utility\MSIZAP.EXE" T {DBDCAA19-597C-11D3-89BB-006008C7D0F2}


Click OK to Run the utility.

When completed, reboot the system.
You should now be able to install NetShield.



Preparing a server to install/reinstall NetShield 4.5..
Delete the Network Associates folders from C:\Program Files and C:\Program Files\Common File folders on installation drive.
If VirusScan 4.5 is installed, run the uninstall from the Control Panel using Add/Remove Programs
From the Start menu, choose Run and execute "REGEDT32"
Browse to HKEY_Local_Machine\System\ControllSet001\ENUM\ROOT
Click on Security | Permissions
Check the option for "Everyone" to have full control (the option in the bottom pane of the Permissions Tab)
Click on "Advanced"
Check the option to 'Reset Permissions on all child objects and enable propagation of inheritable permissions.'
Click 'Apply'
Click 'OK' to the message, "This will remove explicitly defined permissions on all child objects and enable propagation of inheritable permissions to those child objects. Only the inheritable permissions propagates from the LEGACY_***** will take effect. Do you Wish to continue?"
Highlight the following keys one at a time. After insuring the correct key is highlighted, press the "Del" key on your keyboard. Select 'Yes' to the message, "Registry Editor will delete the currently selected key and all its subkeys. Do you want to continue the operation?"
LEGACY_ALERTMANAGER
LEGACY_MCSHIELD
LEGACY_MCTASKMANAGER
LEGACY_NAIFILTR
LEGACY_NAIFSREC
Repeat steps 3-10 for ControllSet002 and ControllSet003 if present.
Delete the folder X:\program files\network associates\virus scan and\or X:\program files\network associates\virusscannt.
Reboot the machine.
You should now be able to run the installation program again.


Reboot.

 

[Guest_imported]

FatesWebb,
I have the same problem in W2K laptop using McAfee VirusScan v4.5.1 SP1, definitions 4.0.4188 and engine 4.1.60

Do you think your solution applies but using the Cleanup Utility for {87AEFD84-BC0D-11D4-B885-00508B022A51} ?

regards,
JuanM

 

[FatesWebb]

these are the manual removals for virusscan (multiple versions) so this would apply more than that would

TRY ALL OF THESE STEPS TO ENSURE YOU HAVE FULLY RESOLVED YOUR ISSUE, SOME STEPS MAY NOT APPLY, SOME STEPS MAY BE SLIGHTLY DIFFERENT IN YOUR OPERATING SYSTEM.

Removing McAfee.com ActiveShield
From ADD/Remove software choose to remove McAfee.com ActiveShield.
Reboot
Go to the start | Run | Programs | McAfee.com Agent
Choose Uninstall
Reboot.
Delete %windir%\mcbin folder and [%windir%\program files\mcafee.com (unless they have or firewall and like it)].
Delete the McAfee.com programs from %windir%\downloaded program files.
Open regedt32.
Remove HKEY_LOCAL_MACHINE\software\mcafee.com (unless other Mcaffee.com software installed.
Select HKEY_LOCAL_MACHINE\system\CurrentControlSet\enum\root\legacy_mcshield and choose security. Give everyone full control. Delete the registry key once you have changed the permissions on the registry key.
Select HKEY_LOCAL_MACHINE\system\CurrentControlSet\enum\root\legacy_NAIFiltr and choose security. Give everyone full control. Delete the registry key once you have changed the permissions on the registry key.
Select HKEY_LOCAL_MACHINE\system\CurrentControlSet\enum\root\legacy_NAIFsRec and choose security. Give everyone full control. Delete the registry key once you have changed the permissions on the registry key.
Remove HKEY_LOCAL_MACHINE\system\CurrentControlSet\services\NAIFsRec
Remove HKEY_LOCAL_MACHINE\system\CurrentControlSet\services\NAIFiltr


Remove the legacy keys following the steps below:
NOTE: The below keys are not installed nor removed by McAfee's software. The effects of removing them cannot be guaranteed by Network Associates.



Select Start | Run, type REGEDT32 and click Ok
Browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\legacy_Avsynmgr
From the Security menu, select Permissions
From the Registry Key Permissions dialog box, select the Everyone Group
Place a check within 'Replace Permissions on Existing Subkeys'
In the Type of Access menu, select Full Control
Select OK
Answer YES to dialog box "Do you want to replace permissions on all existing Subkeys within LEGACY_xxxxx"
From the Edit menu, select Delete
Follow steps 3 through 9 for these keys also:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\legacy_Naifilter
HKLM\SYSTEM\CurrentControlSet\Enum\Root\legacy_NAIFsRec
HKLM\SYSTEM\CurrentControlSet\Enum\Root\legacy_McShield


Cannot do automatic uninstall of virusscan

Backup the registry.

Open the VirusScan control panel applet.
Click the stop button. (if button says ·Start· then the services is stopped. Do not click button).
Confirm that the service has stopped by the VShield icon and VirusScan console icon missing from the Systray in the opposite side of the start menu bar from the Start button.

Run the MSIzap batch program "Remove.bat".
You can get the Microsoft Clean Up Utility from Q238413 ("OFF2000: Windows Installer CleanUp Utility&quot
"

http://support.microsoft.com/support/kb/articles/Q238/4/13.asp"

Install the Cleanup Utility.
Go to Start | Run and browse to C:\Program Files\Windows Cleanup Utility (the default directory) or the directory to which you installed the utility.
Select MSIZAP.EXE and click open.
At the end of the path statement in the Run box, type a space and then the following
McAfee VirusScan 4.5.1 English:
T {87AEFD84-BC0D-11D4-B885-00508B022A51}

NOTE: Your Run line should end up looking similar to this, including the quotes:
"C:\Program Files\Windows Cleanup Utility\MSIZAP.EXE" T {87AEFD84-BC0D-11D4-B885-00508B022A51}

Click OK to Run the utility.

When completed, reboot the system.

Select MSIZAP.EXE and click open.
At the end of the path statement in the Run box, type a space and then the following: T {63CB7620-B423-4BF1-A7E4-75BB8B64740E}

NOTE: Your Run line should end up looking similar to this, including the quotes:
"C:\Program Files\Windows Cleanup Utility\MSIZAP.EXE" T {63CB7620-B423-4BF1-A7E4-75BB8B64740E}


Click OK to Run the utility.

When completed, reboot the system.

Open Regedit
Click the plus sign (+) next to HKEY_LOCAL_MACHINE.
Click the plus sign (+) next to Software.
Click once on the Network Associates folder icon.
Select the TVD key and press the Delete key on the keyboard.
A "Confirm" Key Delete window will appear with the question, "Are you sure you want to delete this key?" Click the Yes button to delete the key.
Click the plus sign (+) next to Microsoft.
Scroll down and click the plus sign (+) next to Windows.
Click the plus sign (+) next to CurrentVersion.
Click the folder icon next to Run services.
On the right side of the window, locate and delete the following entry:
Mcafee VirusScan Service
On the left side of the window, click the folder icon next to SharedDLLs.
On the right side of the window, locate and delete ONLY the following entries:

c:\WIN98SE\SYSTEM\Avsmcpa.cpl
c:\WIN98SE\SYSTEM\Inetwh32.dll
c:\WIN98SE\SYSTEM\MCKRNL.VXD
c:\WIN98SE\SYSTEM\MCSCAN32.VXD
c:\WIN98SE\SYSTEM\MCUTIL.VXD
c:\WIN98SE\SYSTEM\VSHIELD.VXD
c:\WIN98SE\SYSTEM\VSHINIT.VXD

(Your "path" may vary)

On the left side of the window, click the plus sign (+) next to Uninstall.
Locate and delete the 63CB7620-B423-4BF1-A7E4-75BB8B64740E folder under the Uninstall key.
If VirusScan 4.5 was installed with MAPI mail scanning (MS Exchange or Outlook), do the following, otherwise skip to the next step:

Scroll back up and look under the Microsoft key from step 7.
Click the plus sign (+) next to Exchange
Click the plus sign (+) next to Client
Click the plus sign (+) next to Extensions
On the right side of the window, locate and delete Exchange Scan

Scroll back up and look under the Software key from step 3.
Click the plus sign (+) next to Network Associates.
If they exist, locate and delete ONLY the following keys under Network Associates:
Ecare
McAfee VirusScan
SendVir
VirusScan
McAfee WebScanX

Some others may exist ( PGP or Management edition). Do not delete.
Close the Registry Editor by clicking on the X in the upper right hand corner.

Click on Start. The Start menu will appear.
Click on Run in the menu.
Type SYSEDIT in the Open field.
Click the OK button. The System Configuration Editor window will appear. The top window will be labeled C:\AUTOEXEC.BAT
If they exist, delete the following lines by highlighting the line and then pushing the Delete button on the keyboard:
C:\PROGRA~1\COMMON~1\NETWOR~1\VIRUSS~1\40~1.XX
@IF ERRORLEVEL 1 PAUSE
Save the file by clicking on File on the menu and select Save.
Close the System Configuration Editor by clicking on the X in the upper right hand corner of the large window.
Delete McAfee VirusScan Files:
Click on Start|Run.
In the 'Open:' field, type ·C:\Program Files\Network Associates· (with the "&quot and click 'OK'.
Delete the VirusScan folder
Close this window.
Click on Start|Run.
In the Open field, type ·C:\Program Files\common files· (with the "&quot and click 'OK'
Delete the Network Associates folder.
Close all windows
Click on Start|Run.
In the Open field, type X:\%windows%\system and hit return. (where X is the drive letter your windows directory exits and "%windows% is the name of your Windows directory.) and click 'OK'
Delete the following files:
Avsmcpa.cpl
Inetwh32.dll
MCKRNL.VXD
MCSCAN32.VXD
MCUTIL.VXD
VSHIELD.VXD
VSHINIT.VXD