Manually Uninstalling GFI MailEssentials

Overview

Corruption-related issues in the application, environment, or other variables may prevent the system from uninstalling MailEssentials entirely. It is necessary to ensure a full removal for confirming that the application is no longer affecting the processing of messages. This is crucial for isolating issues that are solely related to the environment or other variables.

This article shares the process of manually removing GFI MailEssentials from the server when the regular removal process is not sufficient. 

Note: The article references the following registry keys with their abbreviations: 
HKLM: HKEY_LOCAL_MACHINE
HKCR: HKEY_CLASSES_ROOT

---

 

Process

Manually uninstalling MailEssentials involves four processes:

1. Disabling the Processing of Messages 
2. Removing Services
3. Removing Product Specific Registry Data
4. Removing Installation Metadata from Registry
   • Registry Keys Used for Detecting Installations
   • Counters for Shared DLLs
   • GFI MailEssentials Entry from Add/Remove Programs

 

Disabling Processing of Messages 

Follow the steps below when dealing with Exchange 2003 SMTP (Simple Mail Transfer Protocol) event sinks:

1. Open the MetaEditor/MetaEdit.
   

   Note: Get MetaEditor from Microsoft Downloads.

2. Delete the following binding references:
   
   • HKLM\SmtpSvc\<SMTPINSTANCE>\EventManager\EventTypes\{F6628C90-0D5E-11d2-AA68-00C04FA35B82}\Bindings\{83D5BC59-B6C8-4B77-88B0-B7CA8F3BA1AC}
   • HKLM\SmtpSvc\<SMTPINSTANCE>\EventManager\EventTypes\{F6628C90-0D5E-11d2-AA68-00C04FA35B82}\Bindings\{2F0EF2E3-5A3E-40F6-B021-1BDDB43C35EF}
   • HKLM\SmtpSvc\<SMTPINSTANCE>\EventManager\EventTypes\{FF3CAA23-00B9-11d2-9DFB-00C04FA322BA}\Bindings\{A7D837CC-6273-4DA0-8B83-AFFCC9942B2B}
   • HKLM\SmtpSvc\<SMTPINSTANCE>\EventManager\EventTypes\{FF3CAA23-00B9-11d2-9DFB-00C04FA322BA}\Bindings\{5D631EE6-61BA-4F19-B7C3-4BAFB6A30876}
     

     Note: Only delete the binding reference. Deleting the sink event itself (i.e., F6628C...) instead of the binding event (i.e., 83D5BC...) can cause adverse issues for other applications that are bound to the SMTP event (i.e., FaxMaker).

 

Follow the steps below when dealing with Exchange 2007+ Transport Agents:

1. Start Exchange Management Shell.
2. Execute the following commands:
   • Uninstall-TransportAgent -Identity "GfiAsRtSubmittedAgent"
   • Uninstall-TransportAgent -Identity "GfiAsRtRoutedAgent"
   • Uninstall-TransportAgent -Identity "GfiAsSmtpAgent"
   • Uninstall-TransportAgent -Identity "GfiAsSmtp2Agent"
   • Uninstall-TransportAgent -Identity "GfiAvSmtpAgent"
   • Uninstall-TransportAgent -Identity "GfiAvRoutingAgent"
3. Answer [Y] as 'yes' to confirm.

Removing Services

1. Open regedit.exe.
2. Open HKLM\SYSTEM\CurrentControlSet\Services.
3. Each key listed here represents an individual service. Delete the following keys for MailEssentials:
   • Listserv
   • gfiscans
   • gfimesattendant
   • gfimesavupdate
   • gfiscanm
   • gfimesbackend
   • gfiasmsecatt
   • gfimesqashost
   • gfipop2exch
4. To remove MailEssentials from restore points, delete any instances of these keys present in HKLM\SYSTEM\ControlSet00x\Services.
   

   Note: During normal operations, this is an optional step.

Removing Product Specific Registry Data

1. Open regedit.exe.
2. Delete the following key:
   • On 32-bit environments: HKLM\SOFTWARE\GFI\MailEssentials
   • On 64-bit environments: HKLM\SOFTWARE\WOW6432NODE\GFI\MailEssentials

 

Removing Installation Metadata from Registry

Remove registry keys and metadata values that the bootstrapper and windows installer use for detecting MailEssentials. These remnants, if not removed, can trigger a state in the bootstrapper to start the uninstall chain.

To remove this metadata from the registry keys, open regedit.exe file and perform the steps given in the following sections:

 

Registry Keys Used for Detecting Installations

On Windows 2008 (Vanilla and R2) and Windows 2012:

1. Remove keys under HKCR\Installer\Assemblies that are related to MailEssentials.
2. Find HKCR\Installer\UpgradesCodes\E32D08E2AE81F6D42A2CE4D31919F6F4. It will have two values:
   • Default.
   • A key similar to EA752CE510938D949A7CB96CE709B021 (let’s call this PRODUCTCODE). These are the upgrade and product codes used by the installation to determine the product, update, or version.
3. Find and delete the following:
   • HKCR\Installer\Products\PRODUCTCODE
   • HKCR\Installer\Features\PRODUCTCODE
   • HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\PRODUCTCODE
   • HKCR\Installer\UpgradesCodes\E32D08E2AE81F6D42A2CE4D31919F6F4

 

On Windows 2008 R2 and Windows 2003:

• Remove any keys under HKCR\Installer\Dependencies that are related to MailEssentials. They can be recognized with their DisplayName, which contains 'GFI MailEssentials for Exchange/SMTP'.

On Windows 2008 and Windows 2012:

• Remove any keys under HKCR\Wow6432Node\Installer\Dependencies that are related to MailEssentials. They can be recognized with their DisplayName, which contains 'GFI MailEssentials for Exchange/SMTP'.

Note: The keys deleted in the steps above have the same names that were used to populate the registry key for Add/Remove Programs located at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall.

 

Counters for Shared DLLs

1. Delete any values with the original installation path of MailEssentials from HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs.
2. If no other GFI products are installed, delete any values with \<CommonFilesFolder>\GFI\common.

 

GFI MailEssentials Entry from Add/Remove Programs

1. Navigate to the following key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall.
   

   Note: If the target machine is an x64 environment, navigate to HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall.

2. You will see a bunch of letters and numbers as subkeys of this key. Go through these keys and remove the ones that have the DisplayName set to 'GFI MailEssentials for Exchange/SMTP'. 

Back to top

---