Removal Problem

[JeffLiebermann]

I'm having a problem completely removing Avast4 Home.  It leaves some debris behind that I can't seem to locate and remove.

I successfully used Add-Remove and Avclear4.exe.
Avast4 appeared to be removed.  However on EVERY reboot, Windoze 2000 startup tries to again remove two registry entries.  To detect registry changes, I'm using TeaTimer from SpyBot S&D 1.3.  Without TeaTimer, the typical user would never notice the problem.  It indicates:

System Startup Global Entry:  Value Deleted
Entry = Avast!
C:\Progra~1\Alwils~1\Avast4\ashDisp.???
Entry = ALWILS
C:\Progra~1\Alwils~1\Avast4\ashMaiSv.???

The .??? is compliments of an un-resizesable TeaTimer window that turncates the end of the line.

The TeaTimer startup log show multiple instances of:
6/20/2004 8:25:52 AM Allowed value "avast!" (new data: "") deleted in System Startup global entry!
6/20/2004 8:26:02 AM Allowed value "ashMaiSv" (new data: "") deleted in System Startup global entry!

I've dug through the registry with various search tools (REGEDIT and Windoze Startup Inspector) looking for where these startup items are buried.  No luck.  Where are they hidden so I can vaporize them?

In addition, I've found several branches in the registry apparently owned by Avast that were not removed:
HLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AAVMKER4
HLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWMON
HLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWUPDSV
HLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVAST!_ANTIVIRUS

There are also duplicates under ControlSet001 and ControlSet002 registry branches.  Attempting to delete any of these with REGEDIT  results in "Error while deleting key".  I haven't tried it with REGEDT32 or 3rd party registry tweakers.  Are these entries necessary AFTER removal?  If not, how can they be safely removed?

[whocares]

Hi,

- try disabling Tea-Timer and any other registry-protecting service/program
- then run the avclear again, reboot in SafeMode (F8-Boot) & make sure that the avast-folder and the above avast files are deleted.
- run RegCleaner & reboot again..

 

[DavidR]

In addition, I've found several branches in the registry apparently owned by Avast that were not removed:
HLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AAVMKER4
HLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWMON
HLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWUPDSV
HLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVAST!_ANTIVIRUS

There are also duplicates under ControlSet001 and ControlSet002 registry branches.  Attempting to delete any of these with REGEDIT  results in "Error while deleting key".  I haven't tried it with REGEDT32 or 3rd party registry tweakers.  Are these entries necessary AFTER removal?  If not, how can they be safely removed?

I found similar when I uninstalled AVG and others if I chose to look deep enough.

In regedit, when you have navigated to the key, right click on the key and select permissions... select 'Everyone' and tick the 'Full Control' Allow and click ok.

You will now be able to delete that key as you have permission, a bit drawn out but it works.

HTH David

[radicalb21]

Thanks for the info David. I really appreciate it.

[DavidR]

Thanks for the info David. I really appreciate it.

I can't take full credit here, I'm only passing on what I learnt on these forums. I think it was either Vlk or Igor who mentioned taking permission... I tried it and bingo no more AVG _Legacy keys lying about.

[Stephan123]

have you used the tool to remove all files and register of Avast

[Lisandro]

Sometimes, you need to deleted value by value into the Legacy Keys... Even with permition, seems that the key is locked if it has values in it... When I did one by one, or all values in one key, everything went fine  

[JeffLiebermann]

Ok.  I followed a few suggestions with mixed results.

1.  I rebooted W2K in safe mode with networking and ran AVCLEAR4.EXE again.  It pronounced success.  I rebooted and the attempts by Avast to delete two registry keys appeared again.  That didn't work.

2.  I used REGEDT32.EXE to change the permissions on 12 "legacy" registry keys which then allowed me to delete them.  I suspect that these "legacy" keys were there to provide a history for Microsoft of what was installed and uninstalled, and therefore may have intentionally been left behind after an uninstall of Avast.  I'll call that a success.

So, I'm back to the original problem...

Where is the startup script or registry key buried that endlessly tries to remove the two Avast startup keys?  I've searched through the registry and various places to hide batch files and found nothing with ashDisp or ashMaiSv inside.

System Startup Global Entry:  Value Deleted
Entry = Avast!
C:\Progra~1\Alwils~1\Avast4\ashDisp.???
Entry = ALWILS
C:\Progra~1\Alwils~1\Avast4\ashMaiSv.???

[Juanjo]

We have one customer that have the same problem. He uninstalled avast! but every time when reboot it appears the same Spybot's Teatimer message:

16/04/2006 12:37:49 Permitido (allowed) value "avast!" (new data: "") eliminado (deleted) in System Startup global entry!

He says that he has used the avast! removal tool too, and Regcleaner software, but the problem appears always.

I'm searching in the support forums of avast! and Spybot but I don't find any solution. Anybody have an idea that can help me to solve his problem?

Thanks in advance.

[DavidR]

I would suggest that he disable the teatimer element of spybot and reboot as it can interfere with creation of startup entries and possibly in this case un-installation as it would be attempting to stop the deletion (uninstall) of an avast start-up entry.

Once he has rebooted he should then use the avast uninstall utility and reboot. Then if he absolutely must enable the teatimer again. Personally I think these start-up monitoring tools can be as much hassle as what they are trying to prevent (especially if the user doesn't fully understand how they work), creation, modification or deletion of start-up entries.

[Juanjo]

Thank you for your quick help. That is exactly what I have recommended to him in our forums, I am waiting for his answer.

I agree totally with you when you say that those tools can be a problem used by certain type of users.

Certainly these forums are wonderful!!!

[Lisandro]

He uninstalled avast!

Why? What's wrong?
Can we help him? 

[DavidR]

No problem, hope it helps your customer.

[Juanjo]

Why? What's wrong?
Can we help him? 

Well, I don't know why he uninstalled avast!. He has written a few post in our forums, I think is the typical user that wants to test a lot of programs. In addition he writes badly and sometimes it is difficult to me to understand the meaning of his posts.

I'm sure that he will return to avast! quickly  , as we know avast! have "anything" that makes love it!!!

[Lisandro]

I think is the typical user that wants to test a lot of programs.

So, there is a chance that he comes back