start::
closeprocesses:
createrestorepoint:
C:\Program Files\McAfee
C:\ProgramData\McAfee
deletekey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29B24532-6CE1-41BA-8BF0-F580EA174AF1}
deletekey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}
deletekey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}
deletekey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}
deletekey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}
deletekey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29B24532-6CE1-41BA-8BF0-F580EA174AF1}
deletekey: HKEY_LOCAL_MACHINE\SOFTWARE\McAfee
deletekey: HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\NativeMessagingHosts\siteadvisor.mcafee.chrome.extension
deletekey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{48A61126-9A19-4C50-A214-FF08CB94995C}
deletekey: HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\NativeMessagingHosts\siteadvisor.mcafee.chrome.extension
deletekey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\McAfee
deletekey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\McAfee NGI
deletekey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Edge\NativeMessagingHosts\siteadvisor.mcafee.chrome.extension
deletekey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}
deletekey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Mozilla\NativeMessagingHosts\siteadvisor.mcafee.chrome.extension
deletekey: HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\McAfee WebAdvisor
deletevalue: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-3701234941-3752273002-2774202520-1001|\Device\HarddiskVolume3\Program Files\McAfee\WebAdvisor\uninstaller.exe
deletevalue: HKEY_USERS\S-1-5-21-3701234941-3752273002-2774202520-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched|{6D809377-6AF0-444B-8957-A3773F02200E}\McAfee\WebAdvisor\uihost.exe
emptytemp:
end::