Antivirus uninstall & clean up tools


Recommended Posts

Situation:

When you uninstalled antivirus products through Windows Programs list or Add/Remove Programs, the process failed.

1. All Symantec Removal Tools in One Page

2. Symantec Corporate Products Clean Up Tool

3. avast! uninstall utility

4. AV Uninstaller Tool - Download

5. BitDefender 7, 8, 9 uninstall tool

Link to comment
https://www.neowin.net/forum/topic/485707-antivirus-uninstall-clean-up-tools/
Share on other sites

  • 1 year later...
  • 2 weeks later...
  • 1 month later...

How to clean yourself up? This absotively 100% freewares "toolkit" & process has helped me get thru over a 1,000 spyware/virus clean up calls!

(& I only recall "failing" on 3 of them using it, & imo? They were TRUE "rootkits" & not just trojans driven by a Ring 0/RPL 0/kernelmode driver, but a TRUE subverting of the OS from beneath it @ lower levels than THAT even)

Hopefully? It will yourself, as well, so... here goes:

==========

1.) Reboot your system to F8 @ startup "Windows Advanced Options" bootup menu that stops you during the boot sequence.

2.) There, choose "safemode with networking" (via the "Windows Advanced Options" menu you get presented with while tapping the F8 key repeatedly @ system startup).

3.) Once in safemode with networking Windows, download/install & RUN these tools (they are not much to look at, BUT, they do work on MOST threats today & get regularly updated):

a. Run IE, use its TOOLS menu, Manage Addons Submenu, & turn off ANY BHO etc. objects that you do NOT absolutely NEED, or know what they are (many malwares in the form of bogus toolbars or BHO (browser helper objects) often hide here).

b. Run msconfig.exe, & stall out ANY apps you do NOT absolutely NEED to run (many malware start here in fact). If you do NOT know the name of the program & what it does? Look it up on GOOGLE... same with BHO's above in IE.

c. GET SpyBot 1.51x (download & install)

d. GET ComboFix (download & install)

e. GET SmitFraudFix (download & install)

f. AVG AntiVirus (I suggest this one, because it is free, & just in case your antivirus solution is expired... if it is not expired, update the one you use. Keeping another around for a "2nd Dr.'s Opinion" is NOT a bad idea, BUT: ONLY RUN 1 OF THEM, "resident" (meaning runnings its background application & file scanning engine, usually implemented as a service + trayicon app). IMO, NOD32 is the best performer all-around in terms of antivirus programs. av-comparatives & vb100 tend to 2nd me here as well.

4.) Clean out your rig, running SpyBot, first (most of the threats today are SPYWARE related, or TROJANS, more than std. typical traditional viruses by the way).

5.) Then, run ComboFix (this will reset your webbrowser homepage & background desktop wallpaper, you will have to reset these, & possibly your date/time clock in Windows too).

6.) Then, run SmitFraudFix

7.) Reboot to "normal Windows" (no F8 stuff this round) - it MAY hesitate/be slower this bootup though, because SpyBot/ComboFix/SmitFraud do a 2nd look type check on bootup many times... so, be prepared for this part.

8.) Then, once in normal Windows again, scan with your AntiVirus solution (now fully updated hopefully & if not, do update it first & then scan).

* @ that point? You probably will have 'caught the culprits', OR, @ least have the name + location of any threats they could NOT eliminate... & here is where it gets REALLY "fun"...

==========

NOW, when you CAN'T remove a virus using "script kiddie automated tools" like those noted above (not putting them down calling them that because they ARE somebody's hard work & freely given time as well... but, they ARE that, because they're only automating what YOU can do, yourself, with other tools like msconfig/IE manage addons, & more tools like Process Explorer + regedit & explorer.exe (OR even Recovery Console) can allow YOU to do, yourself, albeit slower... the nice part about the automated killers like the tools I mention above, is that they operate FAR FASTER than human beings do).

-----

IF you can get its name, & location on disk say, via a report from AVG or other programs you use for this?

Boot your system from the OS install CD, & go to RECOVERY CONSOLE!

There, switch to the folder that houses it using CD (almost like DOS one, but uses .. ONLY, to switch to ancestor folder roots really (instead of \ etc. et al))!

Then, once you are in its folder, fry it then (nothing will be loading & thus, locking it, there) using the DEL command -> DEL filename.

----

It's THAT, or using Process Explorer in UserMode/Ring 3/RPL3 operation...

You would do a suspending the calling process via right click popup menu options for this it offers! Once the calling process is suspended (& many times, also the called or DLL injected library as well), you can delete ANY potential offending injected DLL/lib virus-trojan-spyware-malware being called by said parent process, on disk.

(This ia assuming this is a lib loaded virus/spyware/trojan/malware etc., not a standalone .exe type)

That's done via watching loaded DLL's that ANY app may have loaded presently (For that, you would have to use ProExp's CTRL+D keystroke shortcut, with the lower pane view present/visible, & set like that) IF there is one and this thing doesn't launch by itself from one of the registry RUN areas or startup groups that is...

Using Process Explorer can help!

(Again, especially if this is being run by "DLL Injection" (like an OLEServer being injected into a process via CLSIDs, shell extensions, or being run by rundll32.exe OR svchost.exe, process hosting executables that can spawn either .exe OR .dll/lib based ones)).

----

The easier/simpler route?

My first suggestion:

Use Recovery Console, once you have its name & location on disk... DEL command will take care of it, lickety-split, no-****.

APK

P.S. => Additionally:

IF you want to stay "safe?" online, especially today, after cleaning yourself up & setting a restore point (clean one)?

Try this:

https://www.neowin.net/forum/index.php?showtopic=602537

:))

* It works...

APK

REVISION #1 - A BETTER ORDER, & SHORTER:

TRY THIS SET OF TOOLS & TECHNIQUES:

How to clean yourself up?

This "toolkit" & process has helped me get thru over a 1,000 spyware/virus clean up calls, & hopefully? It will yourself, as well, so... here goes:

==========

1.) Reboot your system to F8 @ startup "Windows Advanced Options" bootup menu that stops you during the boot sequence.

----

2.) There, choose "safemode with networking" (via the "Windows Advanced Options" menu you get presented with while tapping the F8 key repeatedly @ system startup).

----

3.) Once in safemode with networking Windows, download/install & RUN these tools (they are not much to look at, BUT, they do work on MOST threats today & get regularly updated):

a. Run IE, use its TOOLS menu, Manage Addons Submenu, & turn off ANY BHO etc. objects that you do NOT absolutely NEED, or know what they are (many malwares in the form of bogus toolbars or BHO (browser helper objects) often hide here).

b. Run msconfig.exe, & stall out ANY apps you do NOT absolutely NEED to run (many malware start here in fact). If you do NOT know the name of the program & what it does? Look it up on GOOGLE... same with BHO's above in IE.

c. DOWNLOAD & INSTALL SpyBot 1.51x

d. DOWNLOAD ComboFix (don't run it yet - there is no installer, it IS its own install + run package)

e. DOWNLOAD SmitFraudFix (which also has its own LSP (layered service provider fix I have heard tell), BUT, againL Don't run it yet - as AGAIN -> there is no installer, it IS its own install + run package)

----

4.) Clean out your rig, running SpyBot, first (most of the threats today are SPYWARE related, or TROJANS, more than std. typical traditional viruses by the way).

----

5.) Then, run ComboFix (this will reset your webbrowser homepage & background desktop wallpaper, you will have to reset these, & possibly your date/time clock in Windows too).

----

6.) Then, run SmitFraudFix

----

7.) Reboot to "normal Windows" (no F8 stuff this round) - it MAY hesitate/be slower this bootup though, because SpyBot/ComboFix/SmitFraud do a 2nd look type check on bootup many times... so, be prepared for this part.

----

8.) Then, once in normal Windows again, scan with your AntiVirus solution (now fully updated hopefully & if not, do update it first & then scan).

Good suggested FREE one, is AVG AntiVirus (I suggest this one, because it is free + complete w/ mail protection too that's decent enough, & just in case your antivirus solution is expired... if it is not expired, update the one you use. Keeping another around for a "2nd Dr.'s Opinion" is NOT a bad idea, BUT: ONLY RUN 1 OF THEM, "resident" (meaning runnings its background application & file scanning engine, usually implemented as a service + trayicon app). IMO, NOD32 is the best performer all-around in terms of antivirus programs. av-comparatives & vb100 tend to 2nd me here as well.

* @ that point? You probably will have 'caught the culprits', OR, @ least have the name + location of any threats they could NOT eliminate... & here is where it gets REALLY "fun"...

==========

NOW, when you CAN'T remove a virus using "script kiddie automated tools" like those noted above (not putting them down calling them that because they ARE somebody's hard work & freely given time as well... but, they ARE that, because they're only automating what YOU can do, yourself, with other tools like msconfig/IE manage addons, & more tools like Process Explorer + regedit & explorer.exe (OR even Recovery Console) can allow YOU to do, yourself, albeit slower... the nice part about the automated killers like the tools I mention above, is that they operate FAR FASTER than human beings do).

ANYHOW - IF you can get its name, & location on disk say, via a report from AVG or other programs you use for this?

Boot your system from the OS install CD, & go to RECOVERY CONSOLE!

There, switch to the folder that houses it using CD (almost like DOS one, but uses .. ONLY, to switch to ancestor folder roots really (instead of \ etc. et al))!

Then, once you are in its folder, fry it then (nothing will be loading & thus, locking it, there) using the DEL command -> DEL filename.

****

It's THAT, or using Process Explorer in UserMode/Ring 3/RPL3 operation...

You would do a suspending the calling process via right click popup menu options for this it offers! Once the calling process is suspended (& many times, also the called or DLL injected library as well), you can delete ANY potential offending injected DLL/lib virus-trojan-spyware-malware being called by said parent process, on disk.

(This ia assuming this is a lib loaded virus/spyware/trojan/malware etc., not a standalone .exe type)

That's done via watching loaded DLL's that ANY app may have loaded presently (For that, you would have to use ProExp's CTRL+D keystroke shortcut, with the lower pane view present/visible, & set like that) IF there is one and this thing doesn't launch by itself from one of the registry RUN areas or startup groups that is...

Using Process Explorer can help!

(Again, especially if this is being run by "DLL Injection" (like an OLEServer being injected into a process via CLSIDs, shell extensions, or being run by rundll32.exe OR svchost.exe, process hosting executables that can spawn either .exe OR .dll/lib based ones)).

****

The easier/simpler route?

My first suggestion:

Use Recovery Console, once you have its name & location on disk... DEL command will take care of it, lickety-split, no-$heet.

APK

P.S. => Additionally:

IF you want to stay "safe?" online, especially today, after cleaning yourself up & setting a restore point (clean one)?

Try this:

https://www.neowin.net/forum/index.php?showtopic=602537

:))

* It works...

thannkyou,

Oh, you're welcome... & you make a point I missed in fact: About deleting browser "temp/cache" files! It's a GOOD MEASURE vs. today's online attack vectors in bogus .js files & such (javascripted OR other types of exploits) - kudos, to you!

ive always had crappy uninstallers. why do most companies always give crappy uninstallers ? isnt there just a way just do like get the installer, and reverse everything it does ?

Well, coming from experience as a developer (for 10 of my 15++ years in this field, professionally)? Many companies often "lay off" development teams (maybe keeping the senior/lead coder @ most), & this is the problem: I don't care WHO YOU ARE, it is nearly impossible to remember "all of your code you ever wrote" & especially, line-for-line.

It is bad enough being the actual coder of a program (OR, a dev team member), & going back to "older code" to patch it - let alone some new guy (usually a student, or someone who is desperate for a job & takes a HUGE paycut to make ends meet, & companies DO take advantage of these kinds of guys naturally (they are LOW COST)).

They have to LEARN all the code AND ITS MECHANICS/ENGINE/ALGORITHMS... takes time, & NO GUARANTEE of being fully correctly understood... thus, the problem imo?

Employee turnovers (specifically coding team members).

plus deleting the temp files n shiz ?

Great point, one I missed in fact!

:)

QUESTION:

May I credit you on other forums for this note, & insert you into those posts regarding this point, on other forums where this is located online?

(You make an EXCELLENT & SOLID POINT - Killing off %temp/tmp% environmental variable temporary operations areas' content, AND in your webbrowser caches too)

Thanks!

APK

  • 1 year later...
  • 4 weeks later...

I just had to use the Norton Removal Tool 2009 to get rid of NIS 2007 from the registry of an XP computer......because it won't let me install the new Symantec Endpoint until everything was gone.

http://service1.symantec.com/Support/tsgen...005033108162039

Or

ftp://ftp.symantec.com/public/english_us_.../removal_tools/

  • 1 month later...

McAfee Removal Tool

F-Secure Internet Security Uninstall Tool

ftp://ftp.f-secure.com/support/tools/uito...llationTool.exe

And\Or Here: ftp://ftp.f-secure.com/anti-virus/tools/removal/uninst23.zip

Viewpoint Removal Tool

Norton Removal tool or direct download h e r e

SUPERAntiSpyware Uninstaller Assistant

Spyware Sweeper Uninstall Tool, an older removal tool is Here

Uninstall Combofix: Start > Run > Combofix /U

* Start->Run-> C:\Program Files\Trend Micro\Internet Security 12\TISSuprt.exe

The Trend Micro Diagnostic Toolkit window will appear. Click on the Uninstall tab

Click on the Un-install button

Click on the Un-install button again when asked if you want to continue with the un-installation

Restart your computer

* Note: If the Trend Micro Diagnostic Toolkit window does not appear

Run: C:\Program Files\Trend Micro\Internet Security 12\PCCTool.exe

Or read here for more info: http://esupport.trendmicro.com/support/vie...p;id=EN-1036064

Norton Removal tool or direct download h e r e

AVG 32Bit uninstall (most users): http://www.avg.com/filedir/util/avg_arm_su.../avgremover.exe

AVG 64Bit uninstall: http://www.avg.com/filedir/util/avg_arv_su...gremoverx64.exe

By the way, this is what I prefer to use (and highly recommend)

icon48.gif Direct Download link for CCleaner: http://download.piriform.com/ccsetup220.exe

malwarebytesgc8.png Direct download link for MalwareBytes: http://www.malwarebytes.org/mbam/program/mbam-setup.exe

SASLogo48x48.gif Direct Download link for SUPERAntiSpyware: http://downloads.superantispyware.com/down...AntiSpyware.exe

1_1_free_AV9_EN.gif Avira free AntiVirus: http://www.free-av.com/en/download/1/downl..._antivirus.html

Actually all of the above is free ;)

Edited by kimsland
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Microsoft's Copilot Cowork now generally available with usage-based billing by Pradeep Viswanathan Back in March, Microsoft first revealed Copilot Cowork, a new agentic AI experience in Microsoft 365 Copilot through which users can assign tasks to AI to complete in the background. After testing the service with a limited set of customers in Research Preview for a few weeks, Microsoft announced the general availability of Copilot Cowork to customers in the Frontier program on March 30. Today, Microsoft announced the general availability of Copilot Cowork worldwide for Microsoft 365 Copilot customers. The company also highlighted that Cowork became the fastest-growing feature in the history of its Frontier program. Unlike regular Copilot Chat, Copilot Cowork can run complex, long-running, multi-tool tasks from start to finish in the cloud by using organizational context through Work IQ. When compared to Claude Cowork, Microsoft claims that Copilot Cowork will be 30% to 40% cheaper on average with its Microsoft 365 connector. For now, Copilot Cowork runs on Anthropic models, including Opus 4.8 and Sonnet 4.6. However, Frontier customers can now use GPT-5.5. Microsoft also announced Cowork 1, a secure fine-tuned model coming in the next few weeks, which is designed to handle everyday Copilot tasks at a lower cost. To access Copilot Cowork, a Microsoft 365 Copilot user subscription is required. Usage is billed separately through Copilot Credits, based on model use, context retrieval, tool calls, and runtime. Pay-as-you-go pricing is set at $0.01 per Copilot Credit. To offer IT teams full control over usage costs, Microsoft provides spending limits, usage alerts, user-level controls, reporting, and prepaid usage plans for organizations. Usage-based billing begins today. However, Frontier customers who used Cowork between March 30 and June 16 will not be billed until July 1, 2026. The Microsoft 365 Copilot app now includes a toggle to enter the full Cowork experience. Microsoft is also adding partner plugins, with Enosix, Harvey, LSEG, Miro, monday.com, Moody’s, Morningstar, S&P Global Energy, and TeamsMaestro available now. Adobe, Atlassian, Box, Canva, Databricks, and others are coming soon.
    • With Nova enabled I am not seeing a difference with compactmode.show?
    • HOLY THREAD REVIVAL   But yes, look for browser.nova.enabled and set it to true
    • 5-year subscription to AdGuard VPN price-dropped now 90% off by Steven Parker Today's highlighted deal comes via our Apps + Software section of the Neowin Deals store, where you can save 88% off a 5-year subscription to AdGuard VPN. In the digital age where internet privacy is paramount, AdGuard VPN emerges as an essential tool. This virtual private network (VPN) is your encrypted gateway to the internet, helping your data stay secure and your online activities remain private, regardless of your location. More than just a privacy tool, AdGuard VPN is a robust solution packed with features that cater to a variety of internet needs. Why AdGuard VPN subscription deal over other VPNs: Exhaustive List of Locations: With 60+ locations available worldwide, you have the freedom to connect from anywhere you want, effectively bypassing geographically restricted content. Check complete list of servers here. Advanced Security Protocol: AdGuard VPN uses its own security protocol, guaranteeing a faster and safer VPN connection. This means you can browse, stream, and download with peace of mind knowing your data is secure. Zero-Logging Policy: Rest assured, your personal data is not collected and your internet traffic stays private at all times, thanks to AdGuard's strict zero-logging policy. Simultaneous Connections: Connect up to 10 devices simultaneously, providing protection for all your devices under just one account. Trusted Developer: AdGuard is a renowned name in the world of computer security, bringing their expertise and commitment to privacy and security to their VPN service. What You Get: Up to 10 devices connected simultaneously All locations Light-speed servers Unlimited data No logs policy Trusted developer Available on all platforms Privacy Created by a team from Russia, AdGuard software Limited is headquartered in Limassol, Cyprus. While the country does follow European privacy laws, it's not part of the 5/9/14 Eyes Alliance. Adguard may not properly work in China. Good to know Length of access: 5 years This plan is only available to new users Redemption deadline: redeem your code within 30 days of purchase Device per license: 10 Access options: desktop & mobile Updates included 5- years of AdGuard VPN normally costs $359.40 without discounts, but it can be yours just $39.97, that's a saving of $324.43 (90%) off. For full terms, specifications, and license info please click the link below. Get this 5-year AdGuard VPN deal for just $34.97 (was $359.40) Although priced in U.S. dollars, this deal is available for digital purchase worldwide. Support queries If you have queries or need support for any of the Neowin Deals, please use the contact form here. Neowin Deals are managed and sold by StackCommerce who represent Neowin on an affiliate basis. Why we post these deals We post these because we earn commission on each sale so as not to rely solely on advertising, which many of our readers block. It all helps toward paying staff reporters, servers and hosting costs. So for those that keep moaning and complaining, be thankful we're still online for you to even do that. Other ways to support Neowin Whitelist Neowin by not blocking our ads Create a free member account to see fewer ads Make a donation to support our day to day running costs Subscribe to Neowin - for $14 a year, or $28 a year for an ad-free experience Disclosure: Neowin benefits from revenue of each sale made through our branded deals site powered by StackCommerce.
    • KillerPDF 1.5.1 by Razvan Serea KillerPDF is a lightweight, portable PDF editor for Windows built for users who want full control without subscriptions, installers, or telemetry. It runs as a single executable, making it ideal for USB use and field work. You can view PDFs with smooth PDFium rendering, navigate quickly with thumbnails, zoom, and shortcuts, and reorganize pages using drag-and-drop. It supports merging multiple PDFs, splitting documents, and extracting selected pages. KillerPDF also allows inline text editing with font matching to preserve the original layout, plus annotations like text boxes, freehand drawing, highlights, and reusable signatures. You can search full text, copy content easily, and print documents with flattened annotations. Designed as a free and open alternative to bloated PDF tools, it works fully offline on Windows 10/11 x64. No runtimes install. Everything needed is inside the EXE (targets .NET Framework 4.8, which ships with every supported Windows release). KillerPDF key features: High-quality PDF rendering via PDFium Edit PDF text inline (double-click to modify text) Page thumbnails and fast navigation with zoom and shortcuts Merge multiple PDFs into one Split PDFs and extract selected pages Drag-and-drop page reordering Font matching to preserve original document appearance Text boxes for notes Freehand drawing tools Highlight overlays with adjustable color, size, opacity Undo actions and clear per-page annotations Create, draw, and save reusable signatures Click-to-place signatures anywhere Full-text search with highlighted results Drag-select or Ctrl+A to copy text Print with annotations flattened Portable single-file app (~10 MB) No installer, no admin rights required No account, no telemetry KillerPDF 1.5.1 changelog: Performance Save Flattened PDF now uses multiple CPU cores. Page rasterization is parallelized (PNG encoding runs across cores; the PDFium render step stays serialized since the library isn't thread-safe), so large documents flatten significantly faster while the UI stays responsive (#68). Fixed PDFs that failed to open with "Unexpected EOF" now open (#72). The failure was PdfSharpCore's Flate inflater (SharpZipLib) rejecting the FlateDecode cross-reference stream on multi-revision PDFs - files that open fine in browsers, Acrobat, and Foxit. KillerPDF now detects this and re-opens the file losslessly through PDFium, preserving selectable text. Thanks to @javajon for the report and a detailed reproduction. Grid view renders every page. It was capped at the first 26 pages, so longer documents stopped loading partway through. Tiles also stream in progressively now instead of blocking until the whole document is rendered. Grid Ctrl+Scroll no longer reloads every page when the zoom is already at its limit and nothing would change. Removed a stray horizontal scrollbar (a thin green line) that could appear across the bottom of grid view. Files on UNC / network shares (including the WSL \\wsl$ filesystem) are copied locally before opening, avoiding partial-read failures on network filesystems. Changed Minimum zoom lowered from 10% to 5%, so grid view can pack more columns (helpful for wide/landscape pages) and single-page view can zoom out further. Download: KillerPDF 1.5.1 | 6.3 MB (Open Source) Link: KillerPDF Home Page | Github | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
  • Recent Achievements

    • One Year In
      Console General earned a badge
      One Year In
    • One Year In
      Twozo Technologies earned a badge
      One Year In
    • One Month Later
      Twozo Technologies earned a badge
      One Month Later
    • Week One Done
      Twozo Technologies earned a badge
      Week One Done
    • Veteran
      branfont went up a rank
      Veteran
  • Popular Contributors

    1. 1
      +primortal
      522
    2. 2
      +Edouard
      196
    3. 3
      PsYcHoKiLLa
      111
    4. 4
      Steven P.
      89
    5. 5
      Nick H.
      71
  • Tell a friend

    Love Neowin? Tell a friend!