Antivirus uninstall & clean up tools

By Copernic
in Essential Guides

 Share

Recommended Posts

Grand Master

Copernic Reporter

Posted
  • Reporter
Posted

Situation:

When you uninstalled antivirus products through Windows Programs list or Add/Remove Programs, the process failed.

1. All Symantec Removal Tools in One Page

2. Symantec Corporate Products Clean Up Tool

3. avast! uninstall utility

4. AV Uninstaller Tool - Download

5. BitDefender 7, 8, 9 uninstall tool

Link to comment
https://www.neowin.net/forum/topic/485707-antivirus-uninstall-clean-up-tools/
Share on other sites
  • 1 year later...
  • 2 weeks later...
  • 1 month later...
Enthusiast

APK

Posted
Posted

How to clean yourself up? This absotively 100% freewares "toolkit" & process has helped me get thru over a 1,000 spyware/virus clean up calls!

(& I only recall "failing" on 3 of them using it, & imo? They were TRUE "rootkits" & not just trojans driven by a Ring 0/RPL 0/kernelmode driver, but a TRUE subverting of the OS from beneath it @ lower levels than THAT even)

Hopefully? It will yourself, as well, so... here goes:

==========

1.) Reboot your system to F8 @ startup "Windows Advanced Options" bootup menu that stops you during the boot sequence.

2.) There, choose "safemode with networking" (via the "Windows Advanced Options" menu you get presented with while tapping the F8 key repeatedly @ system startup).

3.) Once in safemode with networking Windows, download/install & RUN these tools (they are not much to look at, BUT, they do work on MOST threats today & get regularly updated):

a. Run IE, use its TOOLS menu, Manage Addons Submenu, & turn off ANY BHO etc. objects that you do NOT absolutely NEED, or know what they are (many malwares in the form of bogus toolbars or BHO (browser helper objects) often hide here).

b. Run msconfig.exe, & stall out ANY apps you do NOT absolutely NEED to run (many malware start here in fact). If you do NOT know the name of the program & what it does? Look it up on GOOGLE... same with BHO's above in IE.

c. GET SpyBot 1.51x (download & install)

d. GET ComboFix (download & install)

e. GET SmitFraudFix (download & install)

f. AVG AntiVirus (I suggest this one, because it is free, & just in case your antivirus solution is expired... if it is not expired, update the one you use. Keeping another around for a "2nd Dr.'s Opinion" is NOT a bad idea, BUT: ONLY RUN 1 OF THEM, "resident" (meaning runnings its background application & file scanning engine, usually implemented as a service + trayicon app). IMO, NOD32 is the best performer all-around in terms of antivirus programs. av-comparatives & vb100 tend to 2nd me here as well.

4.) Clean out your rig, running SpyBot, first (most of the threats today are SPYWARE related, or TROJANS, more than std. typical traditional viruses by the way).

5.) Then, run ComboFix (this will reset your webbrowser homepage & background desktop wallpaper, you will have to reset these, & possibly your date/time clock in Windows too).

6.) Then, run SmitFraudFix

7.) Reboot to "normal Windows" (no F8 stuff this round) - it MAY hesitate/be slower this bootup though, because SpyBot/ComboFix/SmitFraud do a 2nd look type check on bootup many times... so, be prepared for this part.

8.) Then, once in normal Windows again, scan with your AntiVirus solution (now fully updated hopefully & if not, do update it first & then scan).

* @ that point? You probably will have 'caught the culprits', OR, @ least have the name + location of any threats they could NOT eliminate... & here is where it gets REALLY "fun"...

==========

NOW, when you CAN'T remove a virus using "script kiddie automated tools" like those noted above (not putting them down calling them that because they ARE somebody's hard work & freely given time as well... but, they ARE that, because they're only automating what YOU can do, yourself, with other tools like msconfig/IE manage addons, & more tools like Process Explorer + regedit & explorer.exe (OR even Recovery Console) can allow YOU to do, yourself, albeit slower... the nice part about the automated killers like the tools I mention above, is that they operate FAR FASTER than human beings do).

-----

IF you can get its name, & location on disk say, via a report from AVG or other programs you use for this?

Boot your system from the OS install CD, & go to RECOVERY CONSOLE!

There, switch to the folder that houses it using CD (almost like DOS one, but uses .. ONLY, to switch to ancestor folder roots really (instead of \ etc. et al))!

Then, once you are in its folder, fry it then (nothing will be loading & thus, locking it, there) using the DEL command -> DEL filename.

----

It's THAT, or using Process Explorer in UserMode/Ring 3/RPL3 operation...

You would do a suspending the calling process via right click popup menu options for this it offers! Once the calling process is suspended (& many times, also the called or DLL injected library as well), you can delete ANY potential offending injected DLL/lib virus-trojan-spyware-malware being called by said parent process, on disk.

(This ia assuming this is a lib loaded virus/spyware/trojan/malware etc., not a standalone .exe type)

That's done via watching loaded DLL's that ANY app may have loaded presently (For that, you would have to use ProExp's CTRL+D keystroke shortcut, with the lower pane view present/visible, & set like that) IF there is one and this thing doesn't launch by itself from one of the registry RUN areas or startup groups that is...

Using Process Explorer can help!

(Again, especially if this is being run by "DLL Injection" (like an OLEServer being injected into a process via CLSIDs, shell extensions, or being run by rundll32.exe OR svchost.exe, process hosting executables that can spawn either .exe OR .dll/lib based ones)).

----

The easier/simpler route?

My first suggestion:

Use Recovery Console, once you have its name & location on disk... DEL command will take care of it, lickety-split, no-****.

APK

P.S. => Additionally:

IF you want to stay "safe?" online, especially today, after cleaning yourself up & setting a restore point (clean one)?

Try this:

https://www.neowin.net/forum/index.php?showtopic=602537

:))

* It works...

APK

Enthusiast

APK

Posted
Posted

REVISION #1 - A BETTER ORDER, & SHORTER:

TRY THIS SET OF TOOLS & TECHNIQUES:

How to clean yourself up?

This "toolkit" & process has helped me get thru over a 1,000 spyware/virus clean up calls, & hopefully? It will yourself, as well, so... here goes:

==========

1.) Reboot your system to F8 @ startup "Windows Advanced Options" bootup menu that stops you during the boot sequence.

----

2.) There, choose "safemode with networking" (via the "Windows Advanced Options" menu you get presented with while tapping the F8 key repeatedly @ system startup).

----

3.) Once in safemode with networking Windows, download/install & RUN these tools (they are not much to look at, BUT, they do work on MOST threats today & get regularly updated):

a. Run IE, use its TOOLS menu, Manage Addons Submenu, & turn off ANY BHO etc. objects that you do NOT absolutely NEED, or know what they are (many malwares in the form of bogus toolbars or BHO (browser helper objects) often hide here).

b. Run msconfig.exe, & stall out ANY apps you do NOT absolutely NEED to run (many malware start here in fact). If you do NOT know the name of the program & what it does? Look it up on GOOGLE... same with BHO's above in IE.

c. DOWNLOAD & INSTALL SpyBot 1.51x

d. DOWNLOAD ComboFix (don't run it yet - there is no installer, it IS its own install + run package)

e. DOWNLOAD SmitFraudFix (which also has its own LSP (layered service provider fix I have heard tell), BUT, againL Don't run it yet - as AGAIN -> there is no installer, it IS its own install + run package)

----

4.) Clean out your rig, running SpyBot, first (most of the threats today are SPYWARE related, or TROJANS, more than std. typical traditional viruses by the way).

----

5.) Then, run ComboFix (this will reset your webbrowser homepage & background desktop wallpaper, you will have to reset these, & possibly your date/time clock in Windows too).

----

6.) Then, run SmitFraudFix

----

7.) Reboot to "normal Windows" (no F8 stuff this round) - it MAY hesitate/be slower this bootup though, because SpyBot/ComboFix/SmitFraud do a 2nd look type check on bootup many times... so, be prepared for this part.

----

8.) Then, once in normal Windows again, scan with your AntiVirus solution (now fully updated hopefully & if not, do update it first & then scan).

Good suggested FREE one, is AVG AntiVirus (I suggest this one, because it is free + complete w/ mail protection too that's decent enough, & just in case your antivirus solution is expired... if it is not expired, update the one you use. Keeping another around for a "2nd Dr.'s Opinion" is NOT a bad idea, BUT: ONLY RUN 1 OF THEM, "resident" (meaning runnings its background application & file scanning engine, usually implemented as a service + trayicon app). IMO, NOD32 is the best performer all-around in terms of antivirus programs. av-comparatives & vb100 tend to 2nd me here as well.

* @ that point? You probably will have 'caught the culprits', OR, @ least have the name + location of any threats they could NOT eliminate... & here is where it gets REALLY "fun"...

==========

NOW, when you CAN'T remove a virus using "script kiddie automated tools" like those noted above (not putting them down calling them that because they ARE somebody's hard work & freely given time as well... but, they ARE that, because they're only automating what YOU can do, yourself, with other tools like msconfig/IE manage addons, & more tools like Process Explorer + regedit & explorer.exe (OR even Recovery Console) can allow YOU to do, yourself, albeit slower... the nice part about the automated killers like the tools I mention above, is that they operate FAR FASTER than human beings do).

ANYHOW - IF you can get its name, & location on disk say, via a report from AVG or other programs you use for this?

Boot your system from the OS install CD, & go to RECOVERY CONSOLE!

There, switch to the folder that houses it using CD (almost like DOS one, but uses .. ONLY, to switch to ancestor folder roots really (instead of \ etc. et al))!

Then, once you are in its folder, fry it then (nothing will be loading & thus, locking it, there) using the DEL command -> DEL filename.

****

It's THAT, or using Process Explorer in UserMode/Ring 3/RPL3 operation...

You would do a suspending the calling process via right click popup menu options for this it offers! Once the calling process is suspended (& many times, also the called or DLL injected library as well), you can delete ANY potential offending injected DLL/lib virus-trojan-spyware-malware being called by said parent process, on disk.

(This ia assuming this is a lib loaded virus/spyware/trojan/malware etc., not a standalone .exe type)

That's done via watching loaded DLL's that ANY app may have loaded presently (For that, you would have to use ProExp's CTRL+D keystroke shortcut, with the lower pane view present/visible, & set like that) IF there is one and this thing doesn't launch by itself from one of the registry RUN areas or startup groups that is...

Using Process Explorer can help!

(Again, especially if this is being run by "DLL Injection" (like an OLEServer being injected into a process via CLSIDs, shell extensions, or being run by rundll32.exe OR svchost.exe, process hosting executables that can spawn either .exe OR .dll/lib based ones)).

****

The easier/simpler route?

My first suggestion:

Use Recovery Console, once you have its name & location on disk... DEL command will take care of it, lickety-split, no-$heet.

APK

P.S. => Additionally:

IF you want to stay "safe?" online, especially today, after cleaning yourself up & setting a restore point (clean one)?

Try this:

https://www.neowin.net/forum/index.php?showtopic=602537

:))

* It works...

Enthusiast

APK

Posted
Posted
thannkyou,

Oh, you're welcome... & you make a point I missed in fact: About deleting browser "temp/cache" files! It's a GOOD MEASURE vs. today's online attack vectors in bogus .js files & such (javascripted OR other types of exploits) - kudos, to you!

ive always had crappy uninstallers. why do most companies always give crappy uninstallers ? isnt there just a way just do like get the installer, and reverse everything it does ?

Well, coming from experience as a developer (for 10 of my 15++ years in this field, professionally)? Many companies often "lay off" development teams (maybe keeping the senior/lead coder @ most), & this is the problem: I don't care WHO YOU ARE, it is nearly impossible to remember "all of your code you ever wrote" & especially, line-for-line.

It is bad enough being the actual coder of a program (OR, a dev team member), & going back to "older code" to patch it - let alone some new guy (usually a student, or someone who is desperate for a job & takes a HUGE paycut to make ends meet, & companies DO take advantage of these kinds of guys naturally (they are LOW COST)).

They have to LEARN all the code AND ITS MECHANICS/ENGINE/ALGORITHMS... takes time, & NO GUARANTEE of being fully correctly understood... thus, the problem imo?

Employee turnovers (specifically coding team members).

plus deleting the temp files n shiz ?

Great point, one I missed in fact!

:)

QUESTION:

May I credit you on other forums for this note, & insert you into those posts regarding this point, on other forums where this is located online?

(You make an EXCELLENT & SOLID POINT - Killing off %temp/tmp% environmental variable temporary operations areas' content, AND in your webbrowser caches too)

Thanks!

APK

  • 1 year later...
  • 4 weeks later...
Grand Master

.Kompressor

Posted
Posted

I just had to use the Norton Removal Tool 2009 to get rid of NIS 2007 from the registry of an XP computer......because it won't let me install the new Symantec Endpoint until everything was gone.

http://service1.symantec.com/Support/tsgen...005033108162039

Or

ftp://ftp.symantec.com/public/english_us_.../removal_tools/

  • 1 month later...
Mentor

kimsland

Posted
Posted (edited)

McAfee Removal Tool

F-Secure Internet Security Uninstall Tool

ftp://ftp.f-secure.com/support/tools/uito...llationTool.exe

And\Or Here: ftp://ftp.f-secure.com/anti-virus/tools/removal/uninst23.zip

Viewpoint Removal Tool

Norton Removal tool or direct download h e r e

SUPERAntiSpyware Uninstaller Assistant

Spyware Sweeper Uninstall Tool, an older removal tool is Here

Uninstall Combofix: Start > Run > Combofix /U

* Start->Run-> C:\Program Files\Trend Micro\Internet Security 12\TISSuprt.exe

The Trend Micro Diagnostic Toolkit window will appear. Click on the Uninstall tab

Click on the Un-install button

Click on the Un-install button again when asked if you want to continue with the un-installation

Restart your computer

* Note: If the Trend Micro Diagnostic Toolkit window does not appear

Run: C:\Program Files\Trend Micro\Internet Security 12\PCCTool.exe

Or read here for more info: http://esupport.trendmicro.com/support/vie...p;id=EN-1036064

Norton Removal tool or direct download h e r e

AVG 32Bit uninstall (most users): http://www.avg.com/filedir/util/avg_arm_su.../avgremover.exe

AVG 64Bit uninstall: http://www.avg.com/filedir/util/avg_arv_su...gremoverx64.exe

By the way, this is what I prefer to use (and highly recommend)

icon48.gif Direct Download link for CCleaner: http://download.piriform.com/ccsetup220.exe

malwarebytesgc8.png Direct download link for MalwareBytes: http://www.malwarebytes.org/mbam/program/mbam-setup.exe

SASLogo48x48.gif Direct Download link for SUPERAntiSpyware: http://downloads.superantispyware.com/down...AntiSpyware.exe

1_1_free_AV9_EN.gif Avira free AntiVirus: http://www.free-av.com/en/download/1/downl..._antivirus.html

Actually all of the above is free ;)

Edited by kimsland
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • The official Funny Pictures thread

      By +Edouard · Posted

    • Ocenaudio 3.19.3

      By Copernic · Posted

      Ocenaudio 3.19.3 by Razvan Serea  Ocenaudio is a full featured, fast and easy to use audio and music editor. It is the ideal software for people who need to edit and analyze audio files without complications. Ocenaudio also has powerful features that will please more advanced users. To assist ocenaudio development, a powerful toolset of audio editing, analysis and manipulation called Ocen Framework was created. ocenaudio is also based on Qt framework, a well known library for cross-platform development. Cross-platform support ocenaudio is available for all major operating systems: Microsoft Windows, Mac OS X and Linux. Native applications are generated for each platform from a common source, in order to achieve excelent performance and seamless integration with the operating system. All versions of ocenaudio have a uniform set of features and the same graphical interface, so the skills you learn in one platform can be used in the others. VST plugins support Ocenaudio supports VST (Virtual Studio Technology) plugins, giving its users access to numerous effects. Like the native effects, VST effects can use real-time preview to aide configuration. Real-time preview of effects Applying effects such as EQ, gain and filtering is an important part of audio editing. However, it is very tricky to get the desired result by adjusting the controls configuration alone: you must listen the processed audio. To ease the configuration of audio effects, ocenaudio has a real time preview feature: you hear the processed signal while adjusting the controls. The effect configuration window also includes a miniature view of the selected audio signal. You can navigate on this miniature view in the same way as you do on the main interface, selecting parts that interest you and listening to the effect result in real time. Multiselection for delicate editions To speed up complex audio files editing, ocenaudio includes multi-selection. With this amazing tool, you can simultaneously select different portions of an audio file and listen, edit or even apply an effect to them. For example, if you want to normalize only the excerpts of an interview where the interviewee is talking, just select them and apply the effect. Eficient edition of large files With ocenaudio, there is no limit to the length or the quantity of the audio files you can edit. Using an advanced memory management system, the application keeps your files open without wasting any of your computer's memory. Even in files several hours long, common editing operations such as copy, cut or paste happen almost instantly. Fully featured spectrogram Besides offering an incredible waveform view of your audio files, ocenaudio has a powerful and complete spectrogram view. In this view, you can analyze the spectral content of your audio signal with maximum clarity. Advanced users will be surprised to find that the spectrogram settings are applied in real time. The display is updated immediately when altering features such as the number of frequency bands, window type and size and dynamic range of the display. Ocenaudio 3.19.3 changelog: Fixes issues with MP4 files with more than 8 channels Fixes incorrect VBR detection for some CBR MP3 files Other bug fixes and improvements Download: Ocenaudio 64-bit | Portable | ~40.0 MB (Freeware) Download: Ocenaudio for Linux and Mac OS View: Ocenaudio Homepage | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • DiskGenius 6.2.0.1829 - All Versions: Free, Lite & Portable

      By Copernic · Posted

      DiskGenius 6.2.0.1829 - All Versions: Free, Lite & Portable by Razvan Serea DiskGenius is a full-featured partition manager, which is designed to optimize disk usage for Windows users. It will efficiently help you recover lost data, resize/split partition, backup files, edit hex data, check bad sectors, manage virtual disks, erase data, etc.. Create a system image backup for current Windows with simple clicks to keep the operating system under protection. DiskGenius key features: Partition Management - It can create format, resize, extend, backup, split, hide and clone partition, both MBR and GPT are supported. Disk and partition conversion - Convert dynamic disk to basic, convert virtual disk format and convert MBR to GPT, convert primary partition to logical. File recovery - It can recover files deleted or emptied form recycle bin, recover files from damaged partition or disk and recover files by file type and supports file preview and file filter. Partition recovery - It is the best partition recovery program in that it can recover files from damaged, corrupted and RAW partitions, search for lost partition and recover files from it, besides, it can fix partition table. RAID recovery - It can reconstruct Virtual RAID and recover files from it, and all RAID types are supported. Sector Editor - A Hex editor is embedded to help users edit raw hex data and recover data manually. Backup and Restore - It can backup and restore partition including system partition, hard disk and partition table. Bad Tracks - It can check and repair bad sectors for all storage devices; check hard disk S.M.A.R.T. information. Delete files permanently - It can delete files permanently so that they can't be recovered by any data recovery software. Virtual Disk - It supports virtual disks, including VMware, Virtual PC and Virtual Box. Create WinPE bootable disk and you can manage disk partition when system crashes or there is no operating system on your computer. Support FAT12/FAT16/FAt32/exFAT/NTFS/EXT2/EXT3/EXT4 file system format. DiskGenius 6.2.0.1829 changelog: Add the "Disk Speed Test" feature. Add the "Windows Boot Repair and Conversion" feature. Add the BMB21-2019 erase standard to the "Erase Sectors" feature. Add support for restoring an individual partition from a PMFX disk image file. Enhanced The "Verify Or Repair Bad Sectors/Blocks" feature displays disk read speed in the detection window during scanning. The "Quick Partition" dialog box allows users to quickly select the number of partitions by pressing the numeric keys 1, 2, 7, 8, or 9. The "Set Volume Name" dialog box supports selecting preset volume labels provided by the software. The "Copy Sectors" feature supports resuming copy tasks after modifying the number of skipped bad sectors. Add the "TRIM Optimization" option to the format dialog box. The "Clone Partition" and "Clone Disk" features perform TRIM optimization on target partitions or disks before cloning. Add support for Not Equal To search conditions (prefixed with "!") when searching hexadecimal data in the sector editor. Optimize the display of capacity values in the program interface to show two decimal places. Add a minimize button to dialogs that may require long processing time. Enhance support for the ReFS file system. Enhance support for newer HIF and MP4 formats when recovering files by type. Enhance support for the EXT4 file system. Enhance compatibility of the "File Recovery" feature with special data structures. Fixed Fixed the issue that the selected file system type automatically reverted to NTFS after changing it to exFAT or EXT4 in the "Quick Partition" dialog box. Fixed inaccurate Unicode string search results in the "Sector Editor" feature. Fixed the issue that exceptions might occur when adding multiple disks in the "Erase Sectors" feature. Fixed the issue that insufficient target disk space was incorrectly reported in some cases when cloning, backing up, or restoring disks. Fixed the issue that folder modification timestamps were not preserved when copying files from ReFS partitions. Fixed the issue that Excel-format reports generated by features such as file copying or bad sector checking could not be opened when the report contained more than one million rows. Fixed the issue that folders were not displayed in the exclude-folder dialog box when backing up partitions to image files. Fixed the issue that the "Erase Sectors" feature could not be executed in some cases. Download: DiskGenius 6.2.0.1829 | 63.9 MB (Freeware, paid upgrade available) Download: DiskGenius Portable 64-bit | 40.0 MB Download: DiskGenius Portable 32-bit | 36.0 MB Download: DiskGenius Lite 64-bit | 13.4 MB Download: DiskGenius Lite 32-bit | 11.6 MB View: DiskGenius Home Page | DiskGenius Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • EA Sports UFC 6 review: Brutal, satisfying, and surprisingly accessible to newcomers

      By Steven P. · Posted

      Really? Use a better search engine https://www.google.com/search?...ourceid=chrome&ie=UTF-8
    • The official Funny Pictures thread

      By Steven P. · Posted

  • Recent Achievements

    • Week One Done
      agatameier earned a badge
      Week One Done
    • One Month Later
      agatameier earned a badge
      One Month Later
    • Week One Done
      ssd21345 earned a badge
      Week One Done
    • Contributor
      MarkHughes4096 went up a rank
      Contributor
    • Dedicated
      jordanspringer earned a badge
      Dedicated

  • Popular Contributors

    1. 1
      +primortal
      513
    2. 2
      +Edouard
      182
    3. 3
      PsYcHoKiLLa
      143
    4. 4
      ATLien_0
      95
    5. 5
      Steven P.
      74
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!