Guest

Cisco Security Agent

Manually Uninstalling Cisco Security Agent 4.0

Document ID: 46769

Updated: Feb 02, 2006

   Print

Introduction

This document describes how to manually uninstall Cisco Security Agent (CSA) version 4.0.x. If you are unable to uninstall the CSAgent with Add/Remove programs, or if the Agent uninstall fails, this document provides instruction you can use in order to manually remove the Agent.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on these software and hardware versions.

  • Cisco Security Agent version 4.0.x

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Conventions

Refer to the Cisco Technical Tips Conventions for more information on document conventions.

Manually Uninstall the Cisco Security Agent

Complete these steps in order to manually uninstall the Cisco Security Agent.

  1. Cisco recommends that you perform the uninstallation in Safe Mode. Complete these steps to enter Safe Mode:

    1. Shut down the computer and restart.

    2. Press F8 in order to go to the Windows Advanced Options Menu when the computer boots up.

    3. Use the arrow keys in order to select the menu option for Safe Mode with Networking.

    4. Press Enter.

  2. Delete the \Program Files\InstallShield Installation Information\{DE49974667B9-11D4-97CE-0050DA10E5AE} directory if it exists.

    csa-uninstall-02.gif

  3. Delete these files from the \WINNT\system32\drivers directory.

    • csacenter*.sys

    • csafile*.sys

    • csanet*.sys

    • csareg*.sys

    • csatdi*.sys

    csa-uninstall-03.gif

  4. Delete all references to CSA in the Start Menu\Programs\ directory and any reference to the Cisco Security Agent in the Startup Directory.

    csa-uninstall-04.gif

    csa-uninstall-05.gif

  5. Select Start > Run, type regedit, and click OK in order to launch the Registry Editor.

    csa-uninstall-06.gif

  6. Select HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows NT > CurrentVersion > Windows > AppInit_DLLs.

    csa-uninstall-07.gif

  7. Double-click the AppInit_DLL entry and remove any reference to csauser.dll from the field for Value data. Click OK when you finish.

    csa-uninstall-08.gif

  8. Delete these WINNT or WINDOWS\system32\ files:

    • csafilter.dll

    • csarule.dll

    • csauser.dll

    Note: See step 14 if you are unable to delete the csauser.dll file.

  9. Launch the Registry Editor, as per step 5, and remove these registry keys:

    • HKEY_LOCAL_MACHINE > SYSTEM > ControlSet001 > Control > Session Manager > KnownDLLs > csauser (Data value = csauser.dll)

    • HKEY_LOCAL_MACHINE > SYSTEM > ControlSet002 > Control > Session Manager > KnownDLLs > csauser (Data value = csauser.dll)

    • HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > csacenter

    • HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > csafile

    • HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > csanet

    • HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > csareg

    • HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > csatdi

    • HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > CSAgent

    • HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > csahook

    • HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services >csafilter

    • HKEY_LOCAL_MACHINE > SOFTWARE > Cisco > CSAgent

    • HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows > CurrentVersion > Uninstall > {DE499746-67B9-11D4-97CE-0050DA10E5AE}

  10. Launch the Device Manager at Start > Settings > Control Panel > Administrative Tools > Computer Management > Device Manager.

    csa1.gif

  11. Select View > Show hidden devices in order to ensure that all entries are visible.

    csa2.gif

  12. Uninstall all driver entries that begin with 'csa' or contain a reference to 'Cisco Security Agent' in the Non-plug and Play Drivers section. Do not reboot when you are prompted after you uninstall each driver.

    csa3.gif

  13. Choose to reboot the server into normal mode after you remove the last driver.

  14. If you are unable to delete the csauser.dll file, then log back in and delete the csauser.dll file from WINNT or the WINDOWS\system32\ directory once the server reboots.

  15. If IIS is installed, such as the case for a Cisco Unity, Cisco CallManager, or other server that provides Web services, proceed to the For Cisco Unity, Cisco CallManager and IIS Server Users Only section.

    If you have Apache 1.3 or 2.0 installed, proceed to the For Apache Servers Users Only section. If you do not have IIS or Apache installed, delete the \Program Files\Cisco\CSAgent directory and all directories and files within it..

    Note: Be careful not to delete any other files or directories within \Program Files\Cisco.

For Cisco Unity, Cisco CallManager and IIS Server Users Only

If you manually remove the agent from an IIS server, you may need to remove the ISAPI filter. Failure to do so can create an event log error every time IIS starts. Choose either Option 1 or Option 2. Option 1 requires that you reboot into normal mode. If you are still in safe mode, you need to reboot into normal mode (versus safe mode) to access the requested MMC snap in tool.

Option 1

Complete these steps.

  1. Select Start > Programs > Administrative Tools > Internet Services Manager to launch the Internet Information Services (IIS) Management Console.

  2. Highlight the server name, right-click, and select Properties.

    csa-uninstall-09.gif

  3. Edit the Master Properties for the WWW Service.

    csa-uninstall-10.gif

  4. Select the ISAPI Filters tab from the WWW Service Master Properties window. Highlight the CSAFilter entry and click Remove to delete the filter.

    csa-uninstall-11.gif

  5. Click OK twice to apply your changes and exit.

  6. Close the Internet Information Services Management Console.

  7. Delete the \Program Files\Cisco\CSAgent directory and all directories and files within it.

    Note: Be careful not to delete any other files or directories within \Program Files\Cisco.

    The Program Files directory is located on the C:\ drive in this example.

    csa-uninstall-01.gif

  8. Reboot the server.

Option 2

Complete these steps.

  1. Run the csa_datafilter -u iis command from a command prompt in the ..\csagent\bin directory.

  2. Delete the \Program Files\Cisco\CSAgent directory and all directories and files within it.

    Note: Be careful not to delete any other files or directories within \Program Files\Cisco.

  3. Reboot the server.

For Apache Server Users Only

If you manually remove the agent from an Apache server, you may need to remove the ISAPI filter. Choose either Option 1 or Option 2.

Option 1

Complete these steps for Apache 1.3:

  1. Go to where Apache is installed (normally \Program Files\Apache\).

  2. Use Notepad to open \Apache\Conf\httpd.conf.

  3. Search for csafilter. There should be two locations.

  4. Delete the two lines that you find that begin with:

     "loadmodule csafilter. . ."
        "addmodule mod_csafilter. . ."
  5. Save and close httpd.conf.

  6. Open \Apache\modules\ and delete mod_csafilter*.so.

  7. Delete the \Program Files\Cisco\CSAgent directory and all directories and files within it

    Note: Be careful not to delete any other files or directories within \Program Files\Cisco.

  8. Reboot the server.

Complete these steps for Apache 2.0:

  1. Go to where Apache is installed (normally \Program Files\Apache\).

  2. Use Notepad to open \Apache\Conf\httpd.conf.

  3. Search for csafilter. There should be one match.

  4. Delete the line that you find that begins with loadmodule csafilter. ..

  5. Save and close httpd.conf.

  6. Open \Apache\modules\ and delete mod_csafilter*.so.

  7. Delete the \Program Files\Cisco\CSAgent directory and all directories and files within it.

    Note: Be careful not to delete any other files or directories within \Program Files\Cisco.

  8. Reboot the server.

Option 2

Complete these steps:

  1. Run the appropriate command from a command prompt in the ..\csagent\bin directory:

    • For Apache 1.3:

      • csa_datafilter -u apache13 <.conf file with full path name><modules directory path>

    • For Apache 2.0:

      • csa_datafilter -u apache20<.conf file with full path name><modules directory path>

  2. Delete the \Program Files\Cisco\CSAgent directory and all directories and files within it.

    Note: Be careful not to delete any other files or directories within \Program Files\Cisco.

  3. Reboot the server.

Related Information

Updated: Feb 02, 2006
Document ID: 46769